Ops suspects an S3 bucket or IAM role grants access to an external AWS account. Which tool analyzes resource policies and flags external access automatically?
A.AWS Config
Config evaluates configuration rules — not cross-account policy analysis.
B.IAM Access Analyzer
Correct. External-access findings are Access Analyzer's job.
C.Amazon Inspector
Inspector finds software vulnerabilities.
D.AWS CloudTrail Insights
CloudTrail Insights detects unusual API activity, not policy grants.
Why this answer
IAM Access Analyzer continuously analyzes resource-based policies (S3, roles, KMS keys, etc.) and generates findings for access granted to external principals — the designed tool for unintended-access review.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Operations practice session.
Practice Security Operations