CLF-C02 Practice Question 104: External Access Findings
AWS Certified Cloud Practitioner (CLF-C02) · Test 11 · question 4 of 10
A security team wants to know whether any Amazon S3 buckets, IAM roles or AWS KMS keys in its organization can be accessed by principals outside the organization, such as another AWS account or the public. It wants a finding for each such resource, generated by analyzing the resources' policies, so it can confirm whether the access is intended. Which service provides this?
Show answer and explanation
Answer:
IAM Access Analyzer external access analyzers identify resources in your organization and accounts, such as S3 buckets, IAM roles and KMS keys, that are shared with an external entity. When you create an analyzer, the organization or account you choose is its *zone of trust*. Access Analyzer uses logic-based reasoning to analyze resource-based policies and generates a finding for each resource shared outside that zone, showing the external principal and the access it has. You then review each finding and decide whether the access is intended or a risk.
Option A lists each IAM user and the status of their credentials (passwords, access keys, MFA). It says nothing about which resources are shared outside the organization. Option B makes best-practice recommendations, including some security checks, but it doesn't analyze resource policies across S3, IAM roles and KMS keys to report external access. Option C discovers sensitive data such as PII in S3. It doesn't analyze IAM roles or KMS keys for cross-account access.
Reference: Using AWS Identity and Access Management Access Analyzer