A company manages multiple AWS accounts using AWS Organizations and maintains hundreds of Amazon S3 buckets across these accounts. The security team wants a service that automatically scans all S3 bucket policies and identifies any bucket that grants access to an external AWS account (an account outside the organization). The team needs to receive findings when such policies are detected and wants to review the findings in a centralized dashboard. Which AWS service should the security team use to meet these requirements?

AWS Trusted Advisor

AWS Trusted Advisor inspects AWS environments and provides best-practice recommendations in categories including cost, performance, security, and fault tolerance. It can check S3 bucket permissions for public access, but it does not specifically analyze policies for access granted to specific external AWS accounts, and it does not provide a continuous policy analysis dashboard for external access findings.

AWS Config

AWS Config evaluates the configuration of AWS resources against desired rules and tracks configuration changes. While it can be used to detect changes to S3 bucket policies, it does not natively analyze whether a policy grants access to an external AWS account. Config is more about compliance with internal rules (e.g., 'require encryption') rather than detecting external access.

AWS Service Catalog

AWS Service Catalog helps organizations centrally manage approved IT service catalogs and allows users to launch only pre-approved resources. It does not have any capability to analyze existing S3 bucket policies for external access. This service is used for governance and provisioning, not for post-deployment policy analysis.

What does this CLF-C02 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: AWS IAM Access Analyzer — The scenario requires a service that analyzes resource-based policies (like S3 bucket policies) to detect when they grant access to external AWS accounts. AWS IAM Access Analyzer is designed for this purpose: it continuously analyzes policies attached to supported resources (such as S3 buckets, IAM roles, and KMS keys) and reports any findings where a resource is shared with an entity outside the organization. The findings appear in the IAM Access Analyzer console, providing a centralized dashboard. AWS Trusted Advisor provides general security recommendations but does not perform policy-level analysis for external access. AWS Config tracks resource configuration changes and compliance but does not specifically identify policies that grant access to external accounts. AWS Service Catalog helps organizations create and manage a catalog of approved IT services but does not analyze existing resource policies.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.