IAM Access Analyzer

Correct Answer: Use an S3 bucket policy that limits Principal to the approved AWS account IDs and uses the aws:PrincipalOrgID condition to restrict access to members of your Organization.

The definitive way to enforce which accounts can access an S3 bucket is with a resource-based bucket policy. By specifying the allowed account principals (for example, each account's root or specific roles) and adding a condition such as aws:PrincipalOrgID, you ensure only those approved accounts within your Organization can access the bucket. This is a preventive control evaluated on every request. A custom AWS Config rule and CloudTrail data events provide only detection/monitoring and do not block access. Encrypting with a KMS key protects data at rest but does not constrain which accounts can access the bucket via S3 permissions.

Correct Answer: Create archive rules in IAM Access Analyzer to automatically archive findings that match expected external access.

IAM Access Analyzer generates findings when resource-based policies allow access from outside the zone of trust. To reduce false positives (noise) for known, intended access, you should create archive rules that automatically archive findings matching specific criteria such as the external principal, resource, or actions. This suppresses known-good findings while keeping analysis active for unexpected access. Amazon Inspector sampling has no effect on Access Analyzer, GuardDuty sensitivity settings do not control Access Analyzer behavior, and CloudTrail logging levels do not influence Access Analyzer findings because it analyzes resource policies, not logs.

Correct Answer: IAM Access Analyzer

AWS IAM Access Analyzer is the service specifically designed to analyze access policies, and identifies resources accessible to outside principals. The other services provide different types of monitoring and security functionality.