The Audit Question AWS Access Analyzer Can't Answer

Just before we get started, this article was motivated by two different talks at AWS re:inforce 2025 and fwd:cloudsec Europe 2026 Ever been asked a question where the answer seems simple but actually