The Audit Question AWS Access Analyzer Can't Answer

Just before we get started, this article was motivated by two different talks, one from AWS re:inforce 2025 and the other at fwd:cloudsec Europe 2026 Ever been asked a question where the answer seems