Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to reuse an organization-authored permissions policy across appropriate identities, which calls for Customer managed IAM policies rather than Amazon Cognito identity pools or the earlier IAM role permissions policy.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to reuse an organization-authored permissions policy across appropriate identities, which calls for Customer managed IAM policies rather than IAM Identity Center external directory or the earlier IAM role permissions policy.

IAM role permissions policy primarily supports the earlier need to define which AWS operations a successfully assumed role can perform because permissions policies attached to a role determine allowed service actions within other policy limits, but the new task is to reuse an organization-authored permissions policy across appropriate identities; that is why Customer managed IAM policies is preferable here.

AWS Security Hub primarily supports the earlier need to review centralized security posture and findings from multiple sources because security Hub consolidates and prioritizes findings across AWS security services, but the new task is to review common security and configuration opportunities alongside operational checks; that is why AWS Trusted Advisor is preferable here.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to review common security and configuration opportunities alongside operational checks, which calls for AWS Trusted Advisor rather than AWS Security Center or the earlier AWS Security Hub.

AWS Security Blog is intended to read AWS-authored security guidance, news and technical practices because the AWS Security Blog publishes security-focused articles and examples; in this design the new outcome is to review common security and configuration opportunities alongside operational checks, which calls for AWS Trusted Advisor rather than AWS Security Blog or the earlier AWS Security Hub.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to determine who chooses recovery retention and frequency for business workloads, which calls for Customer backup policy selection rather than AWS S3 infrastructure availability or the earlier Customer encryption configuration.

Customer encryption configuration primarily supports the earlier need to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection, but the new task is to determine who chooses recovery retention and frequency for business workloads; that is why Customer backup policy selection is preferable here.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to determine who chooses recovery retention and frequency for business workloads, which calls for Customer backup policy selection rather than Customer EC2 guest OS patching or the earlier Customer encryption configuration.

IAM group is intended to manage similar IAM user permissions through group membership because an IAM group is a collection of IAM users that can share attached permissions policies; in this design the new outcome is to use a predefined AWS-maintained permissions policy when its scope is appropriate, which calls for AWS managed IAM policies rather than IAM group or the earlier IAM user.

IAM user primarily supports the earlier need to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions, but the new task is to use a predefined AWS-maintained permissions policy when its scope is appropriate; that is why AWS managed IAM policies is preferable here.

IAM resource-based policy is intended to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; in this design the new outcome is to use a predefined AWS-maintained permissions policy when its scope is appropriate, which calls for AWS managed IAM policies rather than IAM resource-based policy or the earlier IAM user.

That description belongs to AWS physical data-center security because AWS controls physical access, environmental safeguards and infrastructure facilities supporting its services; it is used to identify who protects buildings, hardware and physical facilities, not to explain how AWS global network infrastructure provides the function to determine who operates the provider-owned physical networking fabric.

That description belongs to AWS Lambda compute platform because AWS runs and scales the underlying Lambda compute service and manages its infrastructure; it is used to identify who operates the physical and service infrastructure for Lambda execution, not to explain how AWS global network infrastructure provides the function to determine who operates the provider-owned physical networking fabric.

That description belongs to Customer application patching on EC2 because the customer is responsible for custom code and software installed on its virtual machines; it is used to determine who updates software installed by a customer on an EC2 VM, not to explain how AWS global network infrastructure provides the function to determine who operates the provider-owned physical networking fabric.

AWS Config addresses the separate need to identify changes in supported AWS resource settings over time because config maintains resource configuration history and compliance evaluations; it is not as direct as AWS Artifact for the actual requirement to retrieve third-party compliance reports relevant to AWS-operated controls.

AWS Shield Standard addresses the separate need to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources; it is not as direct as AWS Artifact for the actual requirement to retrieve third-party compliance reports relevant to AWS-operated controls.

AWS Well-Architected Tool addresses the separate need to review a workload against architectural best practices including security because the Well-Architected Tool provides structured questions and improvement recommendations; it is not as direct as AWS Artifact for the actual requirement to retrieve third-party compliance reports relevant to AWS-operated controls.

AWS Organizations SCP addresses the separate need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; it is not as direct as AWS Certificate Manager TLS certificates for the actual requirement to provision and manage certificates for supported TLS endpoints.

Data-residency region choice addresses the separate need to select a deployment geography to meet an organization's data-location requirements because customers can select supported Regions and understand where service data is processed or stored; it is not as direct as AWS Certificate Manager TLS certificates for the actual requirement to provision and manage certificates for supported TLS endpoints.

AWS Resource Access Manager sharing addresses the separate need to share supported AWS resources across accounts in a controlled way because AWS RAM enables supported resource sharing with eligible accounts or organizations; it is not as direct as AWS Certificate Manager TLS certificates for the actual requirement to provision and manage certificates for supported TLS endpoints.

AWS KMS managed keys addresses the separate need to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; it is not as direct as AWS Certificate Manager TLS certificates for the actual requirement to provision and manage certificates for supported TLS endpoints.

AWS Security Center addresses the separate need to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; it is not as direct as Amazon Inspector for the actual requirement to assess supported workloads for exploitable software weaknesses.

AWS Shield Standard addresses the separate need to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources; it is not as direct as Amazon Inspector for the actual requirement to assess supported workloads for exploitable software weaknesses.

AWS CloudHSM addresses the separate need to use dedicated hardware modules with direct cryptographic control because cloudHSM provides dedicated hardware security modules for customer-managed keys and crypto operations; it is not as direct as Amazon Inspector for the actual requirement to assess supported workloads for exploitable software weaknesses.

That description belongs to AWS CloudTrail event history because cloudTrail records AWS account API activity and supports investigation of management actions; it is used to review who invoked AWS management API actions in an account, not to explain how AWS Artifact compliance reports provides the function to obtain AWS third-party compliance reports and contractual documents.

That description belongs to AWS Config rules because config rules assess resource settings such as encryption or approved configuration states; it is used to evaluate a configuration against a defined compliance requirement, not to explain how AWS Artifact compliance reports provides the function to obtain AWS third-party compliance reports and contractual documents.

That description belongs to AWS Config configuration history because config records supported resource configurations and evaluates them against configuration rules; it is used to review AWS resource configuration changes and compliance state, not to explain how AWS Artifact compliance reports provides the function to obtain AWS third-party compliance reports and contractual documents.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to reduce exposure of the AWS account's highly privileged root identity, which calls for Root user credential protection rather than IAM Identity Center external directory or the earlier IAM credential report.

IAM credential report primarily supports the earlier need to audit account IAM user credentials and their usage properties because IAM credential reports summarize credential status for IAM users in an account, but the new task is to reduce exposure of the AWS account's highly privileged root identity; that is why Root user credential protection is preferable here.

IAM user is intended to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions; in this design the new outcome is to reduce exposure of the AWS account's highly privileged root identity, which calls for Root user credential protection rather than IAM user or the earlier IAM credential report.

Customer S3 bucket policy addresses the separate need to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; it is not as direct as Customer logging and retention settings for the actual requirement to decide who enables appropriate activity logging and keeps records as required.

Customer RDS access controls addresses the separate need to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; it is not as direct as Customer logging and retention settings for the actual requirement to decide who enables appropriate activity logging and keeps records as required.

Customer application patching on EC2 addresses the separate need to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; it is not as direct as Customer logging and retention settings for the actual requirement to decide who enables appropriate activity logging and keeps records as required.