An audit finds a marketing S3 bucket policy grants s3:GetObject to an unknown external account and several IAM roles have unused EC2 and IAM permissions. The CISO wants prioritized fixes for external and unused access. Which authorization review method best corrects the unintended privileges?
Select an answer to reveal the explanation.
Short Explanation
You've got an open side door plus keys no one's touched in months, and that's exactly what IAM Access Analyzer spots for you. You'll get clear flags on that outside account and stale permissions so you can tidy them up like clearing out old guest passes.
Full Explanation
IAM Access Analyzer is correct because it directly generates prioritized findings for both issues, external access from the bucket policy allowing s3:GetObject to an unknown account and unused access from idle EC2 and IAM actions tracked via CloudTrail, enabling targeted removal with context. The Policy Simulator choice fails by concept because it only tests hypothetical requests against proposed policies before deployment and cannot discover existing cross-account exposure or dormancy. The Trusted Advisor choice fails by concept because it flags general security risks like publicly exposed buckets but lacks detailed unused-permission analysis for roles and cannot identify specific non-public external principals. The Access Advisor choice fails by concept because last-accessed data supports right-sizing unused service permissions but provides no inference of resource-policy-based external sharing. Exam caveat: when a stem combines unknown external principal plus unused actions, favor discovery of current state over prediction, broad hygiene checks, or usage history alone. Practical check: enable an organization-wide analyzer, filter active external and unused findings, confirm business need with owners, remove the external statement and idle actions, then re-analyze to verify zero residual.