Question

A CloudOps engineer at a financial services company must continuously identify any S3 buckets, IAM roles, KMS keys, and SQS queues in a production account whose resource-based policies grant access to external principals outside the organization. The security team wants findings generated automatically whenever a policy is created or modified, with the ability to confirm known cross-account sharing as intended. Which solution meets these requirements with the least operational effort?

Accepted Answer

Enable IAM Access Analyzer with an analyzer scoped to the AWS Organization as the zone of trust, and review and archive findings for known intended external access.

Answer

Create an AWS Config custom rule that parses each resource's policy document with a Lambda function and flags any statement containing a principal from another account.

Answer

Enable Amazon GuardDuty in the production account and create EventBridge rules to alert on cross-account access findings.

Answer

Use IAM Access Advisor to review last-accessed data for each role and manually inspect bucket policies for external principals.