Customer S3 bucket policy addresses the separate need to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; it is not as direct as Customer logging and retention settings for the actual requirement to decide who enables appropriate activity logging and keeps records as required.

Customer RDS access controls addresses the separate need to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; it is not as direct as Customer logging and retention settings for the actual requirement to decide who enables appropriate activity logging and keeps records as required.

Customer application patching on EC2 addresses the separate need to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; it is not as direct as Customer logging and retention settings for the actual requirement to decide who enables appropriate activity logging and keeps records as required.

IAM role trust policy addresses the separate need to define which principals are allowed to assume a specific role because a role trust policy controls the trusted entities for role assumption; it is not as direct as IAM role permissions policy for the actual requirement to define which AWS operations a successfully assumed role can perform.

IAM permissions boundary addresses the separate need to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions; it is not as direct as IAM role permissions policy for the actual requirement to define which AWS operations a successfully assumed role can perform.

IAM identity-based policy addresses the separate need to define what actions an IAM principal may perform on specified resources because identity-based policies attach to users, groups or roles and express allowed or denied actions; it is not as direct as IAM role permissions policy for the actual requirement to define which AWS operations a successfully assumed role can perform.

AWS Organizations SCP primarily supports the earlier need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts, but the new task is to find unintended external or broad permissions on AWS resources; that is why Access analysis is preferable here.

Amazon VPC Flow Logs traffic metadata is intended to record selected IP network-flow information for VPC resources because VPC Flow Logs capture metadata about accepted or rejected traffic at supported interfaces; in this design the new outcome is to find unintended external or broad permissions on AWS resources, which calls for Access analysis rather than Amazon VPC Flow Logs traffic metadata or the earlier AWS Organizations SCP.

AWS Resource Access Manager sharing is intended to share supported AWS resources across accounts in a controlled way because AWS RAM enables supported resource sharing with eligible accounts or organizations; in this design the new outcome is to find unintended external or broad permissions on AWS resources, which calls for Access analysis rather than AWS Resource Access Manager sharing or the earlier AWS Organizations SCP.

Customer encryption configuration is intended to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection; in this design the new outcome is to determine who installs security updates inside a customer-managed EC2 operating system, which calls for Customer EC2 guest OS patching rather than Customer encryption configuration or the earlier AWS managed RDS infrastructure.

Shared patch-management responsibility is intended to recognize how patch duties differ between provider hosts and customer-managed instances because AWS patches infrastructure that it operates; customers patch guest systems and software they control; in this design the new outcome is to determine who installs security updates inside a customer-managed EC2 operating system, which calls for Customer EC2 guest OS patching rather than Shared patch-management responsibility or the earlier AWS managed RDS infrastructure.

AWS managed RDS infrastructure primarily supports the earlier need to identify who handles the underlying operating system for an Amazon RDS DB instance because AWS operates the managed database platform and underlying host maintenance for RDS, but the new task is to determine who installs security updates inside a customer-managed EC2 operating system; that is why Customer EC2 guest OS patching is preferable here.

Amazon Detective addresses the separate need to investigate relationships and context around suspicious activity because detective helps security analysts explore activity and connected evidence; it is not as direct as AWS Security Hub for the actual requirement to review centralized security posture and findings from multiple sources.

Amazon Inspector addresses the separate need to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources; it is not as direct as AWS Security Hub for the actual requirement to review centralized security posture and findings from multiple sources.

AWS CloudHSM addresses the separate need to use dedicated hardware modules with direct cryptographic control because cloudHSM provides dedicated hardware security modules for customer-managed keys and crypto operations; it is not as direct as AWS Security Hub for the actual requirement to review centralized security posture and findings from multiple sources.

AWS Systems Manager Parameter Store addresses the separate need to store configuration parameters and selected secrets for applications because parameter Store provides hierarchical parameter values with access controlled through IAM; it is not as direct as Service-linked IAM role for the actual requirement to delegate service-specific operations to an AWS service under a defined role.

Customer managed IAM policies addresses the separate need to reuse an organization-authored permissions policy across appropriate identities because customer managed policies allow centralized versioning and reuse of customized permissions; it is not as direct as Service-linked IAM role for the actual requirement to delegate service-specific operations to an AWS service under a defined role.

Multi-factor authentication (MFA) addresses the separate need to add a second authentication factor to protect interactive sign-in because mFA requires an additional factor beyond a password or equivalent first credential; it is not as direct as Service-linked IAM role for the actual requirement to delegate service-specific operations to an AWS service under a defined role.

AWS S3 infrastructure availability addresses the separate need to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; it is not as direct as AWS managed RDS infrastructure for the actual requirement to identify who handles the underlying operating system for an Amazon RDS DB instance.

AWS hypervisor maintenance addresses the separate need to identify who maintains the virtualization host beneath an EC2 instance because AWS manages the host operating environment and virtualization components for EC2; it is not as direct as AWS managed RDS infrastructure for the actual requirement to identify who handles the underlying operating system for an Amazon RDS DB instance.

Customer EC2 guest OS patching addresses the separate need to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; it is not as direct as AWS managed RDS infrastructure for the actual requirement to identify who handles the underlying operating system for an Amazon RDS DB instance.

AWS Trusted Advisor security checks is intended to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost; in this design the new outcome is to aggregate and prioritize security findings from AWS and partner services, which calls for AWS Security Hub centralized findings rather than AWS Trusted Advisor security checks or the earlier AWS KMS managed keys.

AWS KMS managed keys primarily supports the earlier need to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads, but the new task is to aggregate and prioritize security findings from AWS and partner services; that is why AWS Security Hub centralized findings is preferable here.

Encryption at rest is intended to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure; in this design the new outcome is to aggregate and prioritize security findings from AWS and partner services, which calls for AWS Security Hub centralized findings rather than Encryption at rest or the earlier AWS KMS managed keys.

Amazon Inspector primarily supports the earlier need to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources, but the new task is to identify changes in supported AWS resource settings over time; that is why AWS Config is preferable here.

Amazon Macie is intended to identify potentially sensitive data stored in Amazon S3 because macie discovers and classifies sensitive information in supported S3 data; in this design the new outcome is to identify changes in supported AWS resource settings over time, which calls for AWS Config rather than Amazon Macie or the earlier Amazon Inspector.

AWS Shield Standard is intended to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources; in this design the new outcome is to identify changes in supported AWS resource settings over time, which calls for AWS Config rather than AWS Shield Standard or the earlier Amazon Inspector.

Customer Lambda function code primarily supports the earlier need to identify who writes and secures the application logic of a Lambda function because customers own the code, dependencies and identity permissions they provide to a Lambda function, but the new task is to identify who protects buildings, hardware and physical facilities; that is why AWS physical data-center security is preferable here.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who protects buildings, hardware and physical facilities, which calls for AWS physical data-center security rather than Customer application patching on EC2 or the earlier Customer Lambda function code.

Customer EC2 security groups is intended to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources; in this design the new outcome is to identify who protects buildings, hardware and physical facilities, which calls for AWS physical data-center security rather than Customer EC2 security groups or the earlier Customer Lambda function code.

Documentation portals do not directly scan running code for CVEs; that caveat is associated more closely with AWS Security Center for the need to find AWS security resources and information in one place than with AWS IAM Access Analyzer for the requirement to detect external sharing and analyze access policies for supported resources.

It does not analyze malware activity across EC2 fleets; that caveat is associated more closely with AWS Secrets Manager for the need to securely store supported credentials and coordinate secret rotation than with AWS IAM Access Analyzer for the requirement to detect external sharing and analyze access policies for supported resources.

It does not focus on writing HTTP request-blocking rules; that caveat is associated more closely with Amazon Inspector for the need to assess supported workloads for exploitable software weaknesses than with AWS IAM Access Analyzer for the requirement to detect external sharing and analyze access policies for supported resources.