A governance team wants continuous evaluation that flags publicly accessible Amazon S3 buckets as noncompliant with city policy. Which AWS service is designed to evaluate resource configurations against such rules?
Select an answer to reveal the explanation.
Short Explanation
Config rules are like a nightly checklist that marks a public bucket as out of policy — continuous evaluation, not a one-time lecture. Transfer Acceleration speeds uploads, Snowball moves data offline, and CloudFront invalidations clear cache — none of those is the compliance rule engine.
Full Explanation
AWS Config can evaluate resource settings with rules and report compliance results, which is what a governance team needs for continuous evaluation that flags publicly accessible Amazon S3 buckets as noncompliant with city policy. Config rules act like a nightly checklist marking a public bucket out of policy rather than delivering a one-time lecture. Amazon S3 Transfer Acceleration speeds long-distance uploads; it is not the compliance engine for bucket policies. AWS Snowball Edge is an offline data-transfer device family and need not be online for every bucket compliance check. Amazon CloudFront invalidations clear cached content; they do not permanently certify bucket privacy. Distractors fail by confusing acceleration, offline transfer, and CDN cache management with configuration compliance evaluation. Exam caveat: Config reports noncompliance; municipal teams must still remediate open buckets, enable Block Public Access where appropriate, and own exception approvals. Operational check: enable Config rules targeting S3 public access, route noncompliant findings to bucket owners, verify remediation within SLA, and sample-audit that citizen-data buckets remain private after application releases.