Exam-style
Before a security sign-off, a team has to show that no principal outside the account can read the S3 bucket holding the knowledge-base source documents or use the KMS key that encrypts the vector index, and that the finding stays true as policies change. Which control produces that proof?
Reveal the answer
E. IAM Access Analyzer with the zone of trust set to the account or the organisation
Access Analyzer evaluates the resource policies themselves, bucket policy, bucket ACLs and key policy together, and lists every principal outside the zone of trust that can reach either resource. Archiving or resolving each finding leaves a record, and it keeps re-evaluating as policies change. Macie classifies content and never says who can reach it. CloudTrail data events record access that already happened, not access that is possible, so an unused cross-account grant leaves no trace in them. A console review is one person’s reading at one moment and does not combine the bucket policy with the key policy. The Config rule catches the public case and misses a named external account or a cross-account role, which is the shape most of these grants actually take.
Q. How do you prove that nothing outside the account can read the knowledge-base bucket or use the key over the vector index?
A. IAM Access Analyzer. Set the zone of trust to the account or the organisation and it evaluates the bucket policy, the bucket ACLs and the key policy on the CMK together, then reports every external principal that can reach either resource. Archive or resolve each finding and the archive is the record. Policy validation in the deployment pipeline checks a new grant before it ships, so the IAM policies to enforce secure data access patterns stay true as they change. Unused-access findings prune what the agent roles stopped needing.
Why? Reachable in principle and accessed in practice are two different records. Access Analyzer covers the first; CloudTrail data events and CloudWatch to monitor data access cover the second. A sign-off pack carries both.