The security team must be notified only when an Amazon S3 bucket becomes publicly exposed in a newly acquired AWS account. The company already has an SNS topic with the security team’s email subscription. Which approach will send notifications only when a bucket is publicly exposed?

The correct approach leverages IAM Access Analyzer to detect publicly exposed S3 buckets and Amazon EventBridge to trigger notifications. IAM Access Analyzer continuously monitors resource policies and identifies public access. By creating an EventBridge rule that filters for "Access Analyzer Finding" events where "isPublic: true," you ensure notifications are sent only when a bucket becomes publicly exposed, and the SNS topic delivers these alerts to the security team. Incorrect options: S3 event notifications do not have a built-in "isPublic" event type; they primarily focus on object-level operations. Monitoring "PutBucketPolicy" API calls via CloudTrail would generate alerts for any policy change, not just those making a bucket public, leading to excessive notifications. While AWS Config can identify non-compliant S3 bucket policies, the cloudtrail-s3-dataevents-enabled rule is for CloudTrail data events, not directly for public S3 bucket exposure. Additionally, filtering for "NONCOMPLIANT" would include many other compliance issues beyond public access.