An IAM role trust policy accidentally allows an external account. The security team wants a finding for unintended external access rather than waiting for the role to be assumed. Which capability should it use?

1. IAM Access Analyzer external access analysis with the intended zone of trust.
2. Inspector image scanning for the role trust document.
3. CloudTrail event lookup as proof that unused external access cannot exist.
4. Macie discovery of the role name in application logs.