A company needs to ensure that their S3 buckets do not have public access enabled due to strict compliance regulations. They want to continuously monitor their environment for any S3 bucket policy changes and automatically trigger an alert if public access is detected. Which combination of services would allow them to meet this requirement?