Exam-style
A team runs a Bedrock knowledge base over documents held in an S3 bucket. An assessor asks them to show that public access to that bucket has been blocked continuously for the last twelve months, not just that it is blocked today. Which service produces that evidence?
Reveal the answer
B. AWS Config, because it records the bucket's configuration as it changes over time and evaluates each recorded state against a rule
AWS Config is the one that keeps a history of state. It records a configuration item every time a resource changes, keeps the timeline, and evaluates each recorded state against rules such as the managed rule for S3 public access, so the answer to “was this blocked on 4 March” is a lookup rather than an inference. Every other option here inspects a different object. AWS CloudTrail records actions: who called which API, from where, and when. It is the right service for “who opened the bucket on the 14th”, and it is the tempting wrong answer because it looks like it covers the year. It does not, because it only writes an entry when somebody does something. A ten-month stretch with no calls against that bucket produces no CloudTrail entries at all, which is equally consistent with the setting being correct the whole time and with the trail having been switched off, or with a change made by a path the trail was not capturing. Absence of a record is not a record of the state. Amazon Inspector inspects software: it scans EC2 instances, container images in Amazon ECR and Lambda functions for known vulnerabilities and unintended network exposure, and it never looks at a bucket policy. AWS Artifact is AWS’s own evidence about AWS, the place to download SOC and ISO reports covering the services underneath, which says nothing about how this team configured its own bucket. AWS Trusted Advisor runs best-practice checks and tells you what is true now across cost, performance, security, fault tolerance, service limits and operational excellence, with no configuration history behind the answer. Sort by the object each one inspects: configuration, actions, software, AWS itself, account hygiene.
Q. Show that the S3 bucket behind a knowledge base has blocked public access continuously for twelve months. Which service produces that evidence?
A. AWS Config, because it records resource configuration over time and evaluates each recorded state against a rule, so the history of the setting is the artefact.
Why? AWS CloudTrail is the tempting answer and it records actions, not state. It writes an entry when somebody calls an API, so a quiet ten months produce nothing, and nothing is not proof that the setting held. Amazon Inspector looks inside software for known vulnerabilities in EC2 instances, container images and Lambda functions, so a bucket policy is outside what it sees. AWS Artifact hands you AWS’s own audit reports about AWS, not evidence about your resources. AWS Trusted Advisor checks best practice as it stands today and keeps no history. Match the object being inspected: configuration, actions, software, AWS itself, account hygiene.