A security team manages an AWS Organization with 40 accounts. An auditor asks for a continuously updated list of S3 buckets, IAM roles and KMS keys whose resource policies grant access to principals outside the organization. The team wants findings to appear automatically as policies change, without building custom scripts.