A security architect wants to programmatically confirm that no S3 buckets or other supported resources unexpectedly allow public or cross-account access, and to preview the effect of permission changes before deploying them. Which AWS capability best meets this need?