That description belongs to Customer application patching on EC2 because the customer is responsible for custom code and software installed on its virtual machines; it is used to determine who updates software installed by a customer on an EC2 VM, not to explain how Customer encryption configuration provides the function to decide who chooses encryption settings and key access rules for customer information.

That description belongs to Customer S3 bucket policy because customers own S3 authorization configuration such as bucket policies and access settings; it is used to decide who restricts public or cross-account access to stored objects, not to explain how Customer encryption configuration provides the function to decide who chooses encryption settings and key access rules for customer information.

That description belongs to Customer backup policy selection because customers establish data recovery objectives and configure suitable backups or managed-service settings; it is used to determine who chooses recovery retention and frequency for business workloads, not to explain how Customer encryption configuration provides the function to decide who chooses encryption settings and key access rules for customer information.

IAM role temporary credentials primarily supports the earlier need to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies, but the new task is to allow a principal in one AWS account to gain defined temporary permissions in another; that is why Cross-account role assumption is preferable here.

Inline IAM policy is intended to bind a permissions policy directly to one identity rather than sharing it because an inline policy maintains a one-to-one association with an IAM user, group or role; in this design the new outcome is to allow a principal in one AWS account to gain defined temporary permissions in another, which calls for Cross-account role assumption rather than Inline IAM policy or the earlier IAM role temporary credentials.

Explicit deny precedence is intended to ensure a denied API action cannot be overridden by another allow statement because an applicable explicit deny in AWS authorization evaluation overrides applicable allows; in this design the new outcome is to allow a principal in one AWS account to gain defined temporary permissions in another, which calls for Cross-account role assumption rather than Explicit deny precedence or the earlier IAM role temporary credentials.

Separation of duties addresses a different objective, to prevent one principal from controlling incompatible business functions, because splitting sensitive privileges among roles reduces misuse and accidental changes; the checklist instead requires the distinct outcomes to review who invoked AWS management API actions in an account; select a deployment geography to meet an organization's data-location requirements.

AWS Config rules addresses a different objective, to evaluate a configuration against a defined compliance requirement, because config rules assess resource settings such as encryption or approved configuration states; the checklist instead requires the distinct outcomes to review who invoked AWS management API actions in an account; select a deployment geography to meet an organization's data-location requirements.

Amazon CloudWatch metrics addresses a different objective, to observe resource utilization and service performance over time, because cloudWatch gathers metrics, alarms and logs for operational monitoring; the checklist instead requires the distinct outcomes to review who invoked AWS management API actions in an account; select a deployment geography to meet an organization's data-location requirements.

That description belongs to IAM role temporary credentials because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is used to provide temporary access to a trusted principal or AWS workload, not to explain how Cross-account role assumption provides the function to allow a principal in one AWS account to gain defined temporary permissions in another.

That description belongs to Explicit deny precedence because an applicable explicit deny in AWS authorization evaluation overrides applicable allows; it is used to ensure a denied API action cannot be overridden by another allow statement, not to explain how Cross-account role assumption provides the function to allow a principal in one AWS account to gain defined temporary permissions in another.

That description belongs to Inline IAM policy because an inline policy maintains a one-to-one association with an IAM user, group or role; it is used to bind a permissions policy directly to one identity rather than sharing it, not to explain how Cross-account role assumption provides the function to allow a principal in one AWS account to gain defined temporary permissions in another.

Amazon CloudWatch metrics primarily supports the earlier need to observe resource utilization and service performance over time because cloudWatch gathers metrics, alarms and logs for operational monitoring, but the new task is to find unintended external or broad permissions on AWS resources; that is why Access analysis is preferable here.

AWS Organizations SCP is intended to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; in this design the new outcome is to find unintended external or broad permissions on AWS resources, which calls for Access analysis rather than AWS Organizations SCP or the earlier Amazon CloudWatch metrics.

Amazon VPC Flow Logs traffic metadata is intended to record selected IP network-flow information for VPC resources because VPC Flow Logs capture metadata about accepted or rejected traffic at supported interfaces; in this design the new outcome is to find unintended external or broad permissions on AWS resources, which calls for Access analysis rather than Amazon VPC Flow Logs traffic metadata or the earlier Amazon CloudWatch metrics.

AWS Knowledge Center primarily supports the earlier need to find answers to common AWS technical and security questions because the Knowledge Center provides support-style articles about known issues and features, but the new task is to find AWS security resources and information in one place; that is why AWS Security Center is preferable here.

AWS Security Hub is intended to review centralized security posture and findings from multiple sources because security Hub consolidates and prioritizes findings across AWS security services; in this design the new outcome is to find AWS security resources and information in one place, which calls for AWS Security Center rather than AWS Security Hub or the earlier AWS Knowledge Center.

AWS Shield Standard is intended to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources; in this design the new outcome is to find AWS security resources and information in one place, which calls for AWS Security Center rather than AWS Shield Standard or the earlier AWS Knowledge Center.

Customer application patching on EC2 primarily supports the earlier need to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines, but the new task is to identify who writes and secures the application logic of a Lambda function; that is why Customer Lambda function code is preferable here.

Customer compliance obligations is intended to determine who ensures application use and data handling meet the customer's regulations because customers remain responsible for their legal obligations, data usage and service configurations; in this design the new outcome is to identify who writes and secures the application logic of a Lambda function, which calls for Customer Lambda function code rather than Customer compliance obligations or the earlier Customer application patching on EC2.

Customer RDS access controls is intended to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; in this design the new outcome is to identify who writes and secures the application logic of a Lambda function, which calls for Customer Lambda function code rather than Customer RDS access controls or the earlier Customer application patching on EC2.

IAM role temporary credentials is intended to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; in this design the new outcome is to grant access through a policy attached to a supported resource, which calls for IAM resource-based policy rather than IAM role temporary credentials or the earlier IAM Access Analyzer policy validation.

IAM Access Analyzer policy validation primarily supports the earlier need to identify policy errors and security warnings before broad access is granted because policy validation analyzes IAM policy documents for issues and best-practice findings, but the new task is to grant access through a policy attached to a supported resource; that is why IAM resource-based policy is preferable here.

Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to grant access through a policy attached to a supported resource, which calls for IAM resource-based policy rather than Amazon Cognito identity pools or the earlier IAM Access Analyzer policy validation.

That description belongs to AWS Config configuration history because config records supported resource configurations and evaluates them against configuration rules; it is used to review AWS resource configuration changes and compliance state, not to explain how Amazon CloudWatch metrics provides the function to observe resource utilization and service performance over time.

That description belongs to AWS Shield DDoS protection because shield provides DDoS protection for supported AWS resources, with additional capabilities in advanced offerings; it is used to reduce the effect of distributed denial-of-service attacks on supported applications, not to explain how Amazon CloudWatch metrics provides the function to observe resource utilization and service performance over time.

That description belongs to Encryption in transit because tLS and similar protocols help secure data exchanged between clients and services; it is used to protect information while it travels over a network, not to explain how Amazon CloudWatch metrics provides the function to observe resource utilization and service performance over time.

Customer EC2 guest OS patching primarily supports the earlier need to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening, but the new task is to recognize how patch duties differ between provider hosts and customer-managed instances; that is why Shared patch-management responsibility is preferable here.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to recognize how patch duties differ between provider hosts and customer-managed instances, which calls for Shared patch-management responsibility rather than Customer application patching on EC2 or the earlier Customer EC2 guest OS patching.

Customer EC2 security groups is intended to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources; in this design the new outcome is to recognize how patch duties differ between provider hosts and customer-managed instances, which calls for Shared patch-management responsibility rather than Customer EC2 security groups or the earlier Customer EC2 guest OS patching.

That description belongs to AWS Security Hub because security Hub consolidates and prioritizes findings across AWS security services; it is used to review centralized security posture and findings from multiple sources, not to explain how AWS Well-Architected Tool provides the function to review a workload against architectural best practices including security.

That description belongs to AWS Security Blog because the AWS Security Blog publishes security-focused articles and examples; it is used to read AWS-authored security guidance, news and technical practices, not to explain how AWS Well-Architected Tool provides the function to review a workload against architectural best practices including security.

That description belongs to AWS Trusted Advisor because trusted Advisor provides best-practice checks in several categories; it is used to review common security and configuration opportunities alongside operational checks, not to explain how AWS Well-Architected Tool provides the function to review a workload against architectural best practices including security.