A security engineer must identify supported resources whose resource-based policies allow access from principals outside the organization. The requirement is policy analysis, not detection of already-occurring network attacks. Which capability is the best fit?

1. IAM Access Analyzer external access findings with the organization configured as the zone of trust.
2. Use only VPC Flow Logs and wait for an external principal to access each resource.
3. Enable GuardDuty and use only its suspicious-activity findings to inventory all externally accessible policies.
4. Run IAM credential reports and assume they list every cross-account resource-policy grant.