A company uses AWS Organizations and has begun using AWS Identity and Access Management (IAM) Access Analyzer to refine overly broad access. The company needs to automatically remediate any newly created IAM policies that allow public or cross-account access, remove external access, and notify the security team. Which combination of steps should a security engineer take to meet these requirements? (Choose three.)

The correct options provide an automated, event-driven remediation and notification system. An Amazon EventBridge rule (formerly CloudWatch Events) can detect active IAM Access Analyzer findings, acting as the trigger. This rule then invokes an AWS Step Functions state machine, which can orchestrate the remediation. The state machine can inspect the finding, identify the resource (e.g., an IAM role), and programmatically add an explicit Deny statement to its trust policy to remove external access. Finally, the Step Functions state machine can publish a notification to an Amazon SNS topic, which the security team is subscribed to, ensuring they are alerted. Incorrect options: AWS Batch is designed for large-scale, high-performance computing workloads, not real-time event-driven remediation of IAM policies. CloudWatch metric filters monitor log data for specific patterns and generate metrics, but they are not the primary mechanism for matching Access Analyzer findings to trigger remediation workflows. EventBridge is designed for this purpose. An SQS queue is for decoupling components and asynchronous messaging; while it could be part of a notification system, it doesn't directly address the requirement for real-time alerts to the security team in the same way SNS does for direct subscriptions.