Exam-style
Before a security sign-off, a team has to show that no principal outside the account can read the S3 bucket holding the knowledge-base source documents or use the KMS key that encrypts the vector index, and that the finding stays true as policies change. Which control produces that proof?
Reveal the answer
E. An IAM Access Analyzer external access analyzer with the zone of trust set to the account or the organisation
The analyzer evaluates the resource policies themselves: the bucket policy, the bucket ACL and any access point on one side, the key policy and the key grants on the other. It lists every principal outside the zone of trust that can reach either resource, re-analyses a changed policy within about 30 minutes, and rescans periodically. Archived findings are retained rather than deleted, so the archive is a record. A Macie discovery job reports what is in the objects, and Macie explicitly leaves KMS key policies out of its analysis. CloudTrail records access that already happened, not access that is possible, so an unused cross-account grant leaves no trace in it. A console review is one person’s reading at one moment and does not combine the bucket policy with the key policy. The Config rule catches the public case and misses a named external account or a cross-account role, which is the shape most of these grants take.
Q. How do you prove that nothing outside the account can read the knowledge-base bucket or use the key over the vector index?
A. An IAM Access Analyzer external access analyzer. Set the zone of trust to the account or the organisation. It evaluates the bucket policy, the bucket ACL and any access point alongside the key policy and grants on the CMK, then reports every external principal that can reach either resource. Archived findings are retained rather than deleted, so the archive is the sign-off record. External access analysis is per Region, so create an analyzer in each Region holding these resources. Custom policy checks in the pipeline, check-no-new-access and check-no-public-access, fail a change before it ships, so a regression in the IAM policies that enforce secure data access patterns gets caught at review. An unused access analyzer lists the services and actions the agent roles have not called.
Why? Reachable in principle and accessed in practice are two different records. Access Analyzer covers the first. CloudTrail covers the second: S3 data events on the bucket, KMS management events on the key, with CloudWatch to monitor data access on top. A sign-off pack carries both.