Requester: Cedar incident coordinator. Evidence: a public policy exists; historical access logging is incomplete. Question: contain the exposure, preserve records, and deliver a recommendation that distinguishes confirmed access settings from unknown download history.
Cedar discovered a public read policy on a bucket intended for internal records. You will work through one account, carrying every accepted change into the next step. The initial resources are a fictional company's starting configuration, not a blank cloud account. Your deliverable is the final account state and the checked decision at the end.
Inspect the named resources before changing them. Earlier work remains part of the requirements, so a later step must preserve it. Some steps use a prepared JSON or YAML file; read its contents and then verify the resulting configuration. Other steps ask for a recommendation supported by the evidence you've established. The final check includes previous requirements as well as the new one, which prevents a quick repair from undoing an earlier protection.