Question

A financial services company must continuously detect any IAM roles, S3 buckets, KMS keys, or other resources across their AWS Organization that grant access to external principals (accounts outside the organization). The security team wants a fully managed solution that generates findings when such external access is detected, aggregates them centrally, and requires minimal custom code. Auditors also require evidence that findings are reviewed and archived when access is intentional. Which approach BEST meets these requirements?

Accepted Answer

Enable IAM Access Analyzer with the organization as the zone of trust in a delegated administrator account, and use archive rules to automatically suppress findings for known-intentional external access.

Answer

Deploy an AWS Config organization conformance pack with custom Lambda rules that parse every resource policy for external ARNs and write results to an S3 evidence bucket.

Answer

Enable GuardDuty across the organization and create EventBridge rules that trigger when GuardDuty detects cross-account access to IAM roles and S3 buckets.

Answer

Use IAM Access Advisor in each member account on a scheduled basis and export the last-accessed data to a central account for review by auditors.