AWS Certificate Manager TLS certificates is intended to provision and manage certificates for supported TLS endpoints because aCM manages public or imported certificates for use with integrated services; in this design the new outcome is to identify software vulnerabilities and unintended network exposure on supported workloads, which calls for Amazon Inspector vulnerability findings rather than AWS Certificate Manager TLS certificates or the earlier Amazon VPC Flow Logs traffic metadata.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to identify software vulnerabilities and unintended network exposure on supported workloads, which calls for Amazon Inspector vulnerability findings rather than AWS KMS managed keys or the earlier Amazon VPC Flow Logs traffic metadata.

Amazon VPC Flow Logs traffic metadata primarily supports the earlier need to record selected IP network-flow information for VPC resources because VPC Flow Logs capture metadata about accepted or rejected traffic at supported interfaces, but the new task is to identify software vulnerabilities and unintended network exposure on supported workloads; that is why Amazon Inspector vulnerability findings is preferable here.

That description belongs to Customer EC2 security groups because customers choose inbound and outbound security-group permissions for their resources; it is used to decide who configures firewall rules around a customer instance, not to explain how Customer application patching on EC2 provides the function to determine who updates software installed by a customer on an EC2 VM.

That description belongs to Customer compliance obligations because customers remain responsible for their legal obligations, data usage and service configurations; it is used to determine who ensures application use and data handling meet the customer's regulations, not to explain how Customer application patching on EC2 provides the function to determine who updates software installed by a customer on an EC2 VM.

That description belongs to AWS hypervisor maintenance because AWS manages the host operating environment and virtualization components for EC2; it is used to identify who maintains the virtualization host beneath an EC2 instance, not to explain how Customer application patching on EC2 provides the function to determine who updates software installed by a customer on an EC2 VM.

IAM role permissions policy addresses the separate need to define which AWS operations a successfully assumed role can perform because permissions policies attached to a role determine allowed service actions within other policy limits; it is not as direct as IAM role temporary credentials for the actual requirement to provide temporary access to a trusted principal or AWS workload.

Cross-account role assumption addresses the separate need to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration; it is not as direct as IAM role temporary credentials for the actual requirement to provide temporary access to a trusted principal or AWS workload.

IAM group addresses the separate need to manage similar IAM user permissions through group membership because an IAM group is a collection of IAM users that can share attached permissions policies; it is not as direct as IAM role temporary credentials for the actual requirement to provide temporary access to a trusted principal or AWS workload.

Service-linked IAM role addresses the separate need to delegate service-specific operations to an AWS service under a defined role because service-linked roles are tied to AWS services and have constrained predefined service purposes; it is not as direct as IAM role temporary credentials for the actual requirement to provide temporary access to a trusted principal or AWS workload.

Inline IAM policy addresses the separate need to bind a permissions policy directly to one identity rather than sharing it because an inline policy maintains a one-to-one association with an IAM user, group or role; it is not as direct as Amazon Cognito identity pools for the actual requirement to provide AWS credentials to application users using supported identities.

Amazon Cognito user pools addresses the separate need to support sign-up and authentication of application end users because cognito user pools provide user directories and authentication features for apps; it is not as direct as Amazon Cognito identity pools for the actual requirement to provide AWS credentials to application users using supported identities.

AWS Organizations member-account guardrails addresses the separate need to restrict maximum access by applying organizational policies because organization-level policies can constrain member accounts regardless of broader IAM allows; it is not as direct as Amazon Cognito identity pools for the actual requirement to provide AWS credentials to application users using supported identities.

Customer managed IAM policies addresses the separate need to reuse an organization-authored permissions policy across appropriate identities because customer managed policies allow centralized versioning and reuse of customized permissions; it is not as direct as Amazon Cognito identity pools for the actual requirement to provide AWS credentials to application users using supported identities.

AWS Security Blog addresses the separate need to read AWS-authored security guidance, news and technical practices because the AWS Security Blog publishes security-focused articles and examples; it is not as direct as AWS IAM Access Analyzer for the actual requirement to detect external sharing and analyze access policies for supported resources.

AWS Security Center addresses the separate need to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; it is not as direct as AWS IAM Access Analyzer for the actual requirement to detect external sharing and analyze access policies for supported resources.

AWS CloudHSM addresses the separate need to use dedicated hardware modules with direct cryptographic control because cloudHSM provides dedicated hardware security modules for customer-managed keys and crypto operations; it is not as direct as AWS IAM Access Analyzer for the actual requirement to detect external sharing and analyze access policies for supported resources.

AWS service compliance inheritance primarily supports the earlier need to use AWS audited infrastructure controls as supporting evidence because customers may inherit relevant provider controls while remaining responsible for their own controls, but the new task is to establish governed multi-account environments with standardized controls; that is why AWS Control Tower landing zone is preferable here.

Amazon GuardDuty threat detection is intended to detect suspicious account or workload behavior from security signals because guardDuty analyzes supported event and telemetry sources to identify potential malicious activity; in this design the new outcome is to establish governed multi-account environments with standardized controls, which calls for AWS Control Tower landing zone rather than Amazon GuardDuty threat detection or the earlier AWS service compliance inheritance.

AWS CloudTrail event history is intended to review who invoked AWS management API actions in an account because cloudTrail records AWS account API activity and supports investigation of management actions; in this design the new outcome is to establish governed multi-account environments with standardized controls, which calls for AWS Control Tower landing zone rather than AWS CloudTrail event history or the earlier AWS service compliance inheritance.

Customer Lambda function code addresses a different objective, to identify who writes and secures the application logic of a Lambda function, because customers own the code, dependencies and identity permissions they provide to a Lambda function; the checklist instead requires the distinct outcomes to identify who sets database credentials and network exposure for an RDS workload; recognize how patch duties differ between provider hosts and customer-managed instances.

AWS global network infrastructure addresses a different objective, to determine who operates the provider-owned physical networking fabric, because AWS manages its worldwide network infrastructure and physical connectivity within its facilities; the checklist instead requires the distinct outcomes to identify who sets database credentials and network exposure for an RDS workload; recognize how patch duties differ between provider hosts and customer-managed instances.

Customer VPC network design addresses a different objective, to determine who selects subnets, routes and exposure within a VPC, because customers design and configure their isolated network environment on AWS; the checklist instead requires the distinct outcomes to identify who sets database credentials and network exposure for an RDS workload; recognize how patch duties differ between provider hosts and customer-managed instances.

Customer backup policy selection primarily supports the earlier need to determine who chooses recovery retention and frequency for business workloads because customers establish data recovery objectives and configure suitable backups or managed-service settings, but the new task is to determine who selects subnets, routes and exposure within a VPC; that is why Customer VPC network design is preferable here.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to determine who selects subnets, routes and exposure within a VPC, which calls for Customer VPC network design rather than AWS S3 infrastructure availability or the earlier Customer backup policy selection.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to determine who selects subnets, routes and exposure within a VPC, which calls for Customer VPC network design rather than Customer EC2 guest OS patching or the earlier Customer backup policy selection.

Amazon CloudWatch metrics addresses the separate need to observe resource utilization and service performance over time because cloudWatch gathers metrics, alarms and logs for operational monitoring; it is not as direct as AWS Config configuration history for the actual requirement to review AWS resource configuration changes and compliance state.

Encryption in transit addresses the separate need to protect information while it travels over a network because tLS and similar protocols help secure data exchanged between clients and services; it is not as direct as AWS Config configuration history for the actual requirement to review AWS resource configuration changes and compliance state.

AWS Config rules addresses the separate need to evaluate a configuration against a defined compliance requirement because config rules assess resource settings such as encryption or approved configuration states; it is not as direct as AWS Config configuration history for the actual requirement to review AWS resource configuration changes and compliance state.

AWS Security Blog primarily supports the earlier need to read AWS-authored security guidance, news and technical practices because the AWS Security Blog publishes security-focused articles and examples, but the new task is to investigate account actions and API activity relevant to a security event; that is why AWS CloudTrail is preferable here.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to investigate account actions and API activity relevant to a security event, which calls for AWS CloudTrail rather than AWS Security Center or the earlier AWS Security Blog.

AWS Knowledge Center is intended to find answers to common AWS technical and security questions because the Knowledge Center provides support-style articles about known issues and features; in this design the new outcome is to investigate account actions and API activity relevant to a security event, which calls for AWS CloudTrail rather than AWS Knowledge Center or the earlier AWS Security Blog.

Credential rotation is intended to reduce risk when long-lived programmatic secrets must be retained because rotating access keys and other secrets limits the lifetime of exposed credentials; in this design the new outcome is to store configuration parameters and selected secrets for applications, which calls for AWS Systems Manager Parameter Store rather than Credential rotation or the earlier IAM Identity Center workforce access.

IAM Identity Center workforce access primarily supports the earlier need to centralize human access to multiple AWS accounts and supported applications because IAM Identity Center supports workforce federation and permission-set based access, but the new task is to store configuration parameters and selected secrets for applications; that is why AWS Systems Manager Parameter Store is preferable here.

Temporary session credentials is intended to avoid long-lived application secrets when making authorized AWS requests because temporary credentials expire and can be issued through IAM roles and federation; in this design the new outcome is to store configuration parameters and selected secrets for applications, which calls for AWS Systems Manager Parameter Store rather than Temporary session credentials or the earlier IAM Identity Center workforce access.