A detective control can tell you that an S3 bucket became public. A preventive control stops the risky change from taking effect.
For many accounts, organisation-level S3 Block Public Access creates the central guardrail.
NestedCerts.com #AWSArchitecture #AWSAI #NestedCerts
