Credential rotation is intended to reduce risk when long-lived programmatic secrets must be retained because rotating access keys and other secrets limits the lifetime of exposed credentials; in this design the new outcome is to store configuration parameters and selected secrets for applications, which calls for AWS Systems Manager Parameter Store rather than Credential rotation or the earlier IAM Identity Center workforce access.

IAM Identity Center workforce access primarily supports the earlier need to centralize human access to multiple AWS accounts and supported applications because IAM Identity Center supports workforce federation and permission-set based access, but the new task is to store configuration parameters and selected secrets for applications; that is why AWS Systems Manager Parameter Store is preferable here.

Temporary session credentials is intended to avoid long-lived application secrets when making authorized AWS requests because temporary credentials expire and can be issued through IAM roles and federation; in this design the new outcome is to store configuration parameters and selected secrets for applications, which calls for AWS Systems Manager Parameter Store rather than Temporary session credentials or the earlier IAM Identity Center workforce access.

That description belongs to IAM credential report because IAM credential reports summarize credential status for IAM users in an account; it is used to audit account IAM user credentials and their usage properties, not to explain how IAM group provides the function to manage similar IAM user permissions through group membership.

That description belongs to Password policy because account password policy governs certain IAM user console passwords; it is used to set complexity and lifetime requirements for applicable IAM user passwords, not to explain how IAM group provides the function to manage similar IAM user permissions through group membership.

That description belongs to IAM permissions boundary because a permissions boundary acts as a ceiling on effective identity-based permissions; it is used to limit the maximum permissions an identity policy can grant to a user or role, not to explain how IAM group provides the function to manage similar IAM user permissions through group membership.

AWS Shield Standard is intended to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources; in this design the new outcome is to securely store supported credentials and coordinate secret rotation, which calls for AWS Secrets Manager rather than AWS Shield Standard or the earlier Amazon Inspector.

Amazon Inspector primarily supports the earlier need to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources, but the new task is to securely store supported credentials and coordinate secret rotation; that is why AWS Secrets Manager is preferable here.

AWS Config is intended to identify changes in supported AWS resource settings over time because config maintains resource configuration history and compliance evaluations; in this design the new outcome is to securely store supported credentials and coordinate secret rotation, which calls for AWS Secrets Manager rather than AWS Config or the earlier Amazon Inspector.

AWS regional facility redundancy addresses the separate need to identify who maintains the independent infrastructure underlying Availability Zones because AWS builds and operates the physical infrastructure supporting Regions and AZs; it is not as direct as Customer encryption configuration for the actual requirement to decide who chooses encryption settings and key access rules for customer information.

Customer EC2 security groups addresses the separate need to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources; it is not as direct as Customer encryption configuration for the actual requirement to decide who chooses encryption settings and key access rules for customer information.

Customer backup policy selection addresses the separate need to determine who chooses recovery retention and frequency for business workloads because customers establish data recovery objectives and configure suitable backups or managed-service settings; it is not as direct as Customer encryption configuration for the actual requirement to decide who chooses encryption settings and key access rules for customer information.

AWS Certificate Manager TLS certificates is intended to provision and manage certificates for supported TLS endpoints because aCM manages public or imported certificates for use with integrated services; in this design the new outcome is to filter HTTP and HTTPS requests reaching supported applications, which calls for AWS WAF web request filtering rather than AWS Certificate Manager TLS certificates or the earlier Amazon Inspector vulnerability findings.

Amazon Inspector vulnerability findings primarily supports the earlier need to identify software vulnerabilities and unintended network exposure on supported workloads because inspector continuously assesses supported resources for vulnerabilities and exposure, but the new task is to filter HTTP and HTTPS requests reaching supported applications; that is why AWS WAF web request filtering is preferable here.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to filter HTTP and HTTPS requests reaching supported applications, which calls for AWS WAF web request filtering rather than AWS KMS managed keys or the earlier Amazon Inspector vulnerability findings.

AWS hardware lifecycle addresses the separate need to identify who replaces failed drives and server components in AWS facilities because AWS handles physical device maintenance and replacement across its data centers; it is not as direct as AWS global network infrastructure for the actual requirement to determine who operates the provider-owned physical networking fabric.

AWS managed RDS infrastructure addresses the separate need to identify who handles the underlying operating system for an Amazon RDS DB instance because AWS operates the managed database platform and underlying host maintenance for RDS; it is not as direct as AWS global network infrastructure for the actual requirement to determine who operates the provider-owned physical networking fabric.

Customer VPC network design addresses the separate need to determine who selects subnets, routes and exposure within a VPC because customers design and configure their isolated network environment on AWS; it is not as direct as AWS global network infrastructure for the actual requirement to determine who operates the provider-owned physical networking fabric.

That description belongs to AWS Knowledge Center because the Knowledge Center provides support-style articles about known issues and features; it is used to find answers to common AWS technical and security questions, not to explain how AWS WAF managed rule groups provides the function to apply common web-request protection patterns using maintained rules.

That description belongs to AWS Trusted Advisor because trusted Advisor provides best-practice checks in several categories; it is used to review common security and configuration opportunities alongside operational checks, not to explain how AWS WAF managed rule groups provides the function to apply common web-request protection patterns using maintained rules.

That description belongs to AWS Firewall Manager because firewall Manager helps centrally deploy supported security protections; it is used to apply common web and network protection policies across accounts, not to explain how AWS WAF managed rule groups provides the function to apply common web-request protection patterns using maintained rules.

That description belongs to AWS Security Hub centralized findings because security Hub centralizes security signals and posture findings across supported sources; it is used to aggregate and prioritize security findings from AWS and partner services, not to explain how AWS Security Lake centralized security data provides the function to collect security logs in an analyzable data lake.

That description belongs to Amazon Macie sensitive-data discovery because macie uses machine learning and pattern matching to discover sensitive data in S3; it is used to locate sensitive information such as personal data in Amazon S3, not to explain how AWS Security Lake centralized security data provides the function to collect security logs in an analyzable data lake.

That description belongs to AWS Trusted Advisor security checks because trusted Advisor offers checks and guidance across areas including security and cost; it is used to review common security and configuration recommendations in AWS accounts, not to explain how AWS Security Lake centralized security data provides the function to collect security logs in an analyzable data lake.

That description belongs to IAM user because IAM users are identities defined within an AWS account with configurable permissions; it is used to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate, not to explain how Credential rotation provides the function to reduce risk when long-lived programmatic secrets must be retained.

That description belongs to Temporary session credentials because temporary credentials expire and can be issued through IAM roles and federation; it is used to avoid long-lived application secrets when making authorized AWS requests, not to explain how Credential rotation provides the function to reduce risk when long-lived programmatic secrets must be retained.

That description belongs to AWS Systems Manager Parameter Store because parameter Store provides hierarchical parameter values with access controlled through IAM; it is used to store configuration parameters and selected secrets for applications, not to explain how Credential rotation provides the function to reduce risk when long-lived programmatic secrets must be retained.

Amazon GuardDuty threat detection addresses the separate need to detect suspicious account or workload behavior from security signals because guardDuty analyzes supported event and telemetry sources to identify potential malicious activity; it is not as direct as AWS Artifact compliance reports for the actual requirement to obtain AWS third-party compliance reports and contractual documents.

Amazon Inspector vulnerability findings addresses the separate need to identify software vulnerabilities and unintended network exposure on supported workloads because inspector continuously assesses supported resources for vulnerabilities and exposure; it is not as direct as AWS Artifact compliance reports for the actual requirement to obtain AWS third-party compliance reports and contractual documents.

Security incident response planning addresses the separate need to prepare containment, investigation and recovery processes before an incident because well-defined incident response combines people, procedures, monitoring and evidence retention; it is not as direct as AWS Artifact compliance reports for the actual requirement to obtain AWS third-party compliance reports and contractual documents.

That description belongs to Customer backup policy selection because customers establish data recovery objectives and configure suitable backups or managed-service settings; it is used to determine who chooses recovery retention and frequency for business workloads, not to explain how Customer VPC network design provides the function to determine who selects subnets, routes and exposure within a VPC.

That description belongs to AWS global network infrastructure because AWS manages its worldwide network infrastructure and physical connectivity within its facilities; it is used to determine who operates the provider-owned physical networking fabric, not to explain how Customer VPC network design provides the function to determine who selects subnets, routes and exposure within a VPC.

That description belongs to Customer application patching on EC2 because the customer is responsible for custom code and software installed on its virtual machines; it is used to determine who updates software installed by a customer on an EC2 VM, not to explain how Customer VPC network design provides the function to determine who selects subnets, routes and exposure within a VPC.