Which AWS service or feature identifies whether an Amazon S3 bucket or an IAM role has been shared with an external entity?