A security team is hardening a member account before a release. They must do two things ahead of deployment. First, given a draft IAM permissions policy that has not yet been attached to a role, they need to confirm whether it would allow a specific s3:PutObject call on a named bucket and see which statement grants or denies it, without making any live API calls. Second, they need continuous, automatic detection of any IAM role, S3 bucket or KMS key in the account that becomes accessible to a principal outside the account as policies change over time. Which two AWS capabilities together satisfy both needs? (Select TWO.)
- AQuery AWS CloudTrail management events in the account to review which principals have already called s3:PutObject on the bucket and from which source addresses.
- BUse the IAM policy simulator to evaluate the draft policy against the s3:PutObject action and the bucket resource, reporting the allow or deny decision and the deciding statement. Correct
- CEnable an AWS Config managed rule for IAM policies so the account records configuration changes and flags policies that do not match the chosen rule parameters.
- DGenerate an IAM policy from the role's recent CloudTrail activity so the team can attach a tightly scoped policy derived from observed calls.
- EEnable IAM Access Analyzer in the account so it continuously analyses resource and trust policies and raises findings whenever a resource becomes accessible to an external principal. Correct
Why A is wrong: CloudTrail records calls that already happened and is tempting for access investigation, but it cannot evaluate an unattached draft policy beforehand nor continuously flag external-access exposure.
Why B is correct: The IAM policy simulator evaluates a policy offline against chosen actions and resources, returning the decision and the responsible statement without issuing any live API call.
Why C is wrong: An AWS Config rule evaluates recorded configuration against fixed criteria and seems relevant to governance, but it neither simulates a specific action decision nor reasons about cross-account access paths.
Why D is wrong: Policy generation from CloudTrail produces a least-privilege draft from past activity and is appealing for hardening, but it does not test a hypothetical action nor continuously detect external access.
Why E is correct: IAM Access Analyzer reasons over resource and trust policies on an ongoing basis and automatically generates a finding when a role, bucket or key is exposed outside the account.