SAA-C03 Practice Question 91: Access Analyzer External Access
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 10 · question 1 of 10
A security team manages an AWS Organization with 40 accounts. An auditor asks for a continuously updated list of S3 buckets, IAM roles and KMS keys whose resource policies grant access to principals outside the organization. The team wants findings to appear automatically as policies change, without building custom scripts.
Which solution meets these requirements?
Show answer and explanation
Answer:
IAM Access Analyzer uses automated reasoning to analyze resource policies and reports resources that are shared with a principal outside the zone of trust. When the analyzer is created for the organization, the zone of trust is the whole organization, so sharing between member accounts is expected and only access from outside the organization produces a finding. It supports S3 buckets, IAM roles, KMS keys and other resource types, and it re-evaluates when a policy changes, which gives the continuously updated, automatic findings the auditor wants.
Option A is threat detection. GuardDuty looks for suspicious activity such as unusual API calls or data exfiltration patterns; it does not inventory which resource policies grant external access.
Option C looks for the wrong thing. Macie classifies the sensitive data inside S3 objects, and it covers neither IAM roles nor KMS keys, nor does it evaluate who a policy trusts.
Option D is too narrow. Trusted Advisor flags S3 buckets with open access permissions, but it does not analyze cross-account grants on IAM roles or KMS keys against an organization boundary.
Reference: What is IAM Access Analyzer?