Question

A SysOps administrator must produce evidence for an upcoming compliance audit showing which S3 buckets, IAM roles, and KMS keys in the account can be accessed by principals outside the AWS Organization. The solution must continuously monitor for new external access and require minimal ongoing effort. What should the administrator do?

Accepted Answer

Enable IAM Access Analyzer with the organization as the zone of trust and review the generated findings for resources shared with external principals

Answer

Run the IAM Policy Simulator against every role and bucket policy on a monthly schedule and export the results to S3

Answer

Enable AWS CloudTrail data events for S3, IAM, and KMS and build a CloudWatch Logs Insights query to detect external access

Answer

Attach a service control policy (SCP) that denies all cross-account access and review the denied API calls in CloudTrail