Exam-style
A team runs a Bedrock knowledge base over documents in an S3 bucket. An assessor asks them to show that public access to that bucket has been blocked continuously for the last twelve months, not just that it is blocked today. Which service produces that evidence?
Reveal the answer
B. AWS Config, because it records the bucket's configuration as it changes over time and evaluates each recorded state against a rule
AWS Config keeps the history of state. It records a configuration item each time a resource changes, retains that timeline, and evaluates each recorded state against rules such as the managed rule s3-bucket-level-public-access-prohibited, so “was this blocked on 4 March” is a lookup, as long as the recorder was running across the period. AWS CloudTrail records actions: who called which API, from where, and when. It answers “who opened the bucket on the 14th”, and it looks like it covers the year. It writes an entry only when somebody does something. Ten quiet months produce no entries, which is equally consistent with the setting holding, with the trail being switched off, and with a change made by a path the trail was not capturing. Absence of a record is not a record of state. Amazon Inspector scans software: EC2 instances, ECR container images, Lambda functions and source repositories, for known vulnerabilities and unintended network exposure, never a live bucket’s settings. AWS Artifact supplies AWS’s own SOC, ISO and PCI reports and Marketplace vendor documents, which say nothing about this team’s own bucket. AWS Trusted Advisor reports what is true now, and its security checks do include S3 bucket permissions, but no configuration history sits behind the result. Sort by the object each one inspects: configuration, actions, software, AWS itself, account hygiene.
Q. Show that the S3 bucket behind a knowledge base has blocked public access continuously for twelve months. Which service produces that evidence?
A. AWS Config, because it records resource configuration over time and evaluates each recorded state against a rule, so the history of the setting is the artefact, provided the recorder was running for the period.
Why? AWS CloudTrail is the tempting pick, and it records actions, not state. It writes an entry when somebody calls an API, so a quiet ten months produce nothing, and nothing is not proof that the setting held. Amazon Inspector looks inside software for known vulnerabilities in EC2 instances, ECR container images, Lambda functions and source repositories, so a live bucket’s settings sit outside what it scans. AWS Artifact supplies AWS’s own SOC, ISO and PCI reports, not evidence about your resources. AWS Trusted Advisor does check S3 bucket permissions, but only as they stand today, with no history behind the result. Match the object being inspected: configuration, actions, software, AWS itself, account hygiene.