Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 173 discussion

A. No, because Amazon S3 can NOT currently publish notifications for isPublic events. https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html B. Yes, because IAM Access Analyzer for S3 alerts you to S3 buckets that are configured to allow access to anyone on the internet or other AWS accounts https://aws.amazon.com/blogs/security/how-to-prioritize-iam-access-analyzer-findings/ C. No, because PutBucketPolicy notifies us of an Amazon S3 bucket policy event to an Amazon S3 bucket, and we are looking for a SPECIFIC event to the bucket permissions, not ALL events. D. No, because cloudtrail-s3-dataevents-enabled checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets. https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-s3-dataevents-enabled.html

https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-analyzer.html

This question.. is seriously ! a googling one

Option B

it's B

Ideally, I would use config rule, but here, of course, they suggest the wrong rule. The other option remains the access analyzer

keyword = AWS Identity and Access Management Access Analyzer then B

The code by God_is_love did not worked for me. I guess something has been changed. The following code worked in my environment. { "source":["aws.access-analyzer"], "detail-type":["Access Analyzer Finding"], "detail": { "isPublic":[true] } }

Aws is letter B Previous writing is a error

Letter C

https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-eventbridge.html

B eventbirdge and access analyser

B is the correct solution because it uses AWS Identity and Access Management Access Analyzer to continuously monitor access control configurations and detect whether any S3 buckets have been configured to be publicly accessible. When a publicly accessible bucket is detected, an Amazon EventBridge rule is triggered, and the SNS topic is notified with the finding.

Access Analyzer is to assess the access policy. https://docs.aws.amazon.com/ja_jp/AmazonS3/latest/userguide/access-control-block-public-access.html

https://aws.amazon.com/blogs/security/how-to-use-aws-iam-access-analyzer-api-to-automate-detection-of-public-access-to-aws-kms-keys/

https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-analyzer.html

D by elimination rule