Detect unintended external access

4.2Basic

A data account operates S3, IAM roles, and KMS keys.

Find resources that a different account could access unintentionally.

Which authorization approach is most appropriate?

Hint 1: Focus on the requirement

Analyze what policies permit, not only what has already appeared in an access log.

Hint 2: Key terms

Separate identity permissions, resource policies, data-granular controls, and organization guardrails.

Access Analyzer: A service that analyzes resource policies for external access and validates policies.
External access: A permission path from a principal outside the intended account or organization.
Policy validation: Checks that identify policy errors or risky structure.
Unintended sharing: Access granted beyond the approved trust boundary.

Question IDAWS-DEA-267

EnvironmentAWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認

Last technical review2026-08-20

More practice in this area