That description belongs to AWS Security Hub because security Hub consolidates and prioritizes findings across AWS security services; it is used to review centralized security posture and findings from multiple sources, not to explain how AWS Well-Architected Tool provides the function to review a workload against architectural best practices including security.

That description belongs to AWS Security Blog because the AWS Security Blog publishes security-focused articles and examples; it is used to read AWS-authored security guidance, news and technical practices, not to explain how AWS Well-Architected Tool provides the function to review a workload against architectural best practices including security.

That description belongs to AWS Trusted Advisor because trusted Advisor provides best-practice checks in several categories; it is used to review common security and configuration opportunities alongside operational checks, not to explain how AWS Well-Architected Tool provides the function to review a workload against architectural best practices including security.

IAM Identity Center external directory addresses the separate need to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; it is not as direct as Federated identity access for the actual requirement to let an existing external identity provider authenticate users for AWS access.

Password policy addresses the separate need to set complexity and lifetime requirements for applicable IAM user passwords because account password policy governs certain IAM user console passwords; it is not as direct as Federated identity access for the actual requirement to let an existing external identity provider authenticate users for AWS access.

Avoid shared credentials addresses the separate need to retain individual accountability for actions taken in AWS because separate identities and temporary role sessions support attribution and selective access removal; it is not as direct as Federated identity access for the actual requirement to let an existing external identity provider authenticate users for AWS access.

Cross-account role assumption addresses the separate need to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration; it is not as direct as Federated identity access for the actual requirement to let an existing external identity provider authenticate users for AWS access.

AWS Security Center addresses the separate need to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; it is not as direct as AWS Firewall Manager for the actual requirement to apply common web and network protection policies across accounts.

AWS Config addresses the separate need to identify changes in supported AWS resource settings over time because config maintains resource configuration history and compliance evaluations; it is not as direct as AWS Firewall Manager for the actual requirement to apply common web and network protection policies across accounts.

AWS Marketplace security solutions addresses the separate need to obtain eligible third-party security software through AWS Marketplace because marketplace offers third-party and AWS software listings for procurement and deployment; it is not as direct as AWS Firewall Manager for the actual requirement to apply common web and network protection policies across accounts.

Amazon Macie sensitive-data discovery is intended to locate sensitive information such as personal data in Amazon S3 because macie uses machine learning and pattern matching to discover sensitive data in S3; in this design the new outcome is to record selected IP network-flow information for VPC resources, which calls for Amazon VPC Flow Logs traffic metadata rather than Amazon Macie sensitive-data discovery or the earlier Encryption in transit.

Encryption in transit primarily supports the earlier need to protect information while it travels over a network because tLS and similar protocols help secure data exchanged between clients and services, but the new task is to record selected IP network-flow information for VPC resources; that is why Amazon VPC Flow Logs traffic metadata is preferable here.

Encryption at rest is intended to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure; in this design the new outcome is to record selected IP network-flow information for VPC resources, which calls for Amazon VPC Flow Logs traffic metadata rather than Encryption at rest or the earlier Encryption in transit.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to decide who grants access permissions to customer data and AWS resources, which calls for Customer IAM permission design rather than AWS S3 infrastructure availability or the earlier Customer data classification.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to decide who grants access permissions to customer data and AWS resources, which calls for Customer IAM permission design rather than Customer EC2 guest OS patching or the earlier Customer data classification.

Customer data classification primarily supports the earlier need to decide who labels business data by sensitivity before selecting controls because customers classify information and determine required access and protection levels, but the new task is to decide who grants access permissions to customer data and AWS resources; that is why Customer IAM permission design is preferable here.

That description belongs to AWS IAM Access Analyzer because access Analyzer produces findings and policy analysis that aid least-privilege reviews; it is used to detect external sharing and analyze access policies for supported resources, not to explain how AWS Shield Standard provides the function to provide baseline DDoS protections for supported AWS resources.

That description belongs to Amazon Inspector because inspector identifies vulnerability and exposure findings for covered resources; it is used to assess supported workloads for exploitable software weaknesses, not to explain how AWS Shield Standard provides the function to provide baseline DDoS protections for supported AWS resources.

That description belongs to AWS Security Center because AWS security portals collect information about AWS cloud security capabilities; it is used to find AWS security resources and information in one place, not to explain how AWS Shield Standard provides the function to provide baseline DDoS protections for supported AWS resources.

IAM role temporary credentials addresses a different objective, to provide temporary access to a trusted principal or AWS workload, because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; the checklist instead requires the distinct outcomes to understand why a principal cannot act without an applicable permission; audit account IAM user credentials and their usage properties.

IAM Identity Center external directory addresses a different objective, to integrate existing workforce identities with AWS account access, because identity Center can work with supported external identity sources for centralized access; the checklist instead requires the distinct outcomes to understand why a principal cannot act without an applicable permission; audit account IAM user credentials and their usage properties.

Amazon Cognito identity pools addresses a different objective, to provide AWS credentials to application users using supported identities, because cognito identity pools exchange supported authentication for temporary AWS credentials; the checklist instead requires the distinct outcomes to understand why a principal cannot act without an applicable permission; audit account IAM user credentials and their usage properties.

That description belongs to AWS Lambda compute platform because AWS runs and scales the underlying Lambda compute service and manages its infrastructure; it is used to identify who operates the physical and service infrastructure for Lambda execution, not to explain how AWS regional facility redundancy provides the function to identify who maintains the independent infrastructure underlying Availability Zones.

That description belongs to AWS managed RDS infrastructure because AWS operates the managed database platform and underlying host maintenance for RDS; it is used to identify who handles the underlying operating system for an Amazon RDS DB instance, not to explain how AWS regional facility redundancy provides the function to identify who maintains the independent infrastructure underlying Availability Zones.

That description belongs to AWS hypervisor maintenance because AWS manages the host operating environment and virtualization components for EC2; it is used to identify who maintains the virtualization host beneath an EC2 instance, not to explain how AWS regional facility redundancy provides the function to identify who maintains the independent infrastructure underlying Availability Zones.

AWS Firewall Manager centralized policies addresses the separate need to apply supported firewall protections consistently across multiple AWS accounts because firewall Manager provides central policy management for protections such as WAF and Shield-related configurations; it is not as direct as Data-residency region choice for the actual requirement to select a deployment geography to meet an organization's data-location requirements.

Amazon Macie sensitive-data discovery addresses the separate need to locate sensitive information such as personal data in Amazon S3 because macie uses machine learning and pattern matching to discover sensitive data in S3; it is not as direct as Data-residency region choice for the actual requirement to select a deployment geography to meet an organization's data-location requirements.

AWS Audit Manager evidence collection addresses the separate need to organize evidence of AWS usage for audit assessments because audit Manager helps collect and organize evidence against control frameworks; it is not as direct as Data-residency region choice for the actual requirement to select a deployment geography to meet an organization's data-location requirements.

That description belongs to AWS KMS managed keys because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; it is used to control encryption keys for supported AWS integrated services, not to explain how AWS Firewall Manager centralized policies provides the function to apply supported firewall protections consistently across multiple AWS accounts.

That description belongs to Centralized security logging because central collection helps security staff investigate activity without relying on individual workloads; it is used to retain and correlate audit records from multiple accounts, not to explain how AWS Firewall Manager centralized policies provides the function to apply supported firewall protections consistently across multiple AWS accounts.

That description belongs to AWS Resource Access Manager sharing because AWS RAM enables supported resource sharing with eligible accounts or organizations; it is used to share supported AWS resources across accounts in a controlled way, not to explain how AWS Firewall Manager centralized policies provides the function to apply supported firewall protections consistently across multiple AWS accounts.

Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to reuse an organization-authored permissions policy across appropriate identities, which calls for Customer managed IAM policies rather than Amazon Cognito identity pools or the earlier IAM role permissions policy.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to reuse an organization-authored permissions policy across appropriate identities, which calls for Customer managed IAM policies rather than IAM Identity Center external directory or the earlier IAM role permissions policy.

IAM role permissions policy primarily supports the earlier need to define which AWS operations a successfully assumed role can perform because permissions policies attached to a role determine allowed service actions within other policy limits, but the new task is to reuse an organization-authored permissions policy across appropriate identities; that is why Customer managed IAM policies is preferable here.