IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions

• AWS IAM Access Analyzer

See also

• aws accessanalyzer [ list-findings | list-findings-v2 | create-analyzer ]
• AWS IAM Access Analyzer: aws accessanalyzer
• Keeping Infrastructure as Code Secure (KICS), execution example