A municipality wants centralized detection of overly permissive IAM policies and unintended public resource exposure across all Organization accounts. Which security approach best provides these findings?
Select an answer to reveal the explanation.
Short Explanation
You cannot catch a door left open across fifty accounts with a yearly clipboard walk. Access Analyzer spots risky shares and wild policies; Security Hub rolls findings into one SOC view. Turning the detectors off just for peace and quiet is backwards.
Full Explanation
Centralized detection of overly permissive IAM policies and unintended public resource exposure across a municipality’s Organization accounts is delivered by IAM Access Analyzer findings aggregated with AWS Security Hub (and related detectors) in a delegated security account. Access Analyzer continuously evaluates resource policies and external access, while Security Hub provides the multi-account aggregation, severity normalization, and workflow the SOC needs. That combination replaces annual paper reviews with continuous, organization-scoped visibility.
Reviewing IAM only during annual paper audits without analyzers or Security Hub leaves months of public-bucket or wildcard-principal exposure undetected. Turning off Config, GuardDuty, and Access Analyzer organization-wide to reduce finding volume disables the very detective controls required. Granting every account AdministratorAccess so permission boundaries “no longer need analysis” maximizes risk rather than reducing the need for analysis.
Exam caveat: Access Analyzer findings about external access pair naturally with Security Hub aggregation and Config/GuardDuty; know which service finds which class of issue. Operational check: enable Access Analyzer and Security Hub delegated admin for the Organization, introduce a deliberate public-ACL test resource in a sandbox, confirm the finding appears centrally, and verify member accounts cannot silently disable the org-managed detectors without SCP protection.