You are managing a central AWS account in your company. You need a tool to analyze access control policies in resources such as S3 and determine if resources can be accessed publicly or from other AWS accounts. With this tool, you can protect the resources from unexpected access from outside. Which option should be selected to achieve the requirement?

Answer options:

A.Download the Credential Report from IAM and analyze the unexpected access.
B.Download the service access report of the AWS Organization.
C.Check the Access Advisor of IAM roles or S3 bucket policies.
D.Create an IAM Access Analyzer and review the findings.

Correct Answer – D
Option A is incorrect: Because Credential Report lists the users and their credentials. However, it cannot provide the access information.
Option B is incorrect: Because the question does not mention AWS Organization, and the service access report does not tell if resources can be accessed from outside.
Option C is incorrect: Because Access Advisor provides the last accessed information for the allowed services. But it does not identify the services that may be accessed publicly from the outside.
Option D is CORRECT: Because IAM Access Analyzer can identify resources that are shared with external entities.
Reference:
https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html