AWS regional facility redundancy addresses the separate need to identify who maintains the independent infrastructure underlying Availability Zones because AWS builds and operates the physical infrastructure supporting Regions and AZs; it is not as direct as Customer application patching on EC2 for the actual requirement to determine who updates software installed by a customer on an EC2 VM.

Customer EC2 guest OS patching addresses the separate need to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; it is not as direct as Customer application patching on EC2 for the actual requirement to determine who updates software installed by a customer on an EC2 VM.

Customer S3 bucket policy addresses the separate need to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; it is not as direct as Customer application patching on EC2 for the actual requirement to determine who updates software installed by a customer on an EC2 VM.

IAM permissions boundary primarily supports the earlier need to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions, but the new task is to bind a permissions policy directly to one identity rather than sharing it; that is why Inline IAM policy is preferable here.

Cross-account role assumption is intended to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration; in this design the new outcome is to bind a permissions policy directly to one identity rather than sharing it, which calls for Inline IAM policy rather than Cross-account role assumption or the earlier IAM permissions boundary.

IAM user is intended to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions; in this design the new outcome is to bind a permissions policy directly to one identity rather than sharing it, which calls for Inline IAM policy rather than IAM user or the earlier IAM permissions boundary.

KMS key policies do not decide which data is personally identifiable; that caveat is associated more closely with AWS KMS managed keys for the need to control encryption keys for supported AWS integrated services than with AWS Firewall Manager centralized policies for the requirement to apply supported firewall protections consistently across multiple AWS accounts.

SCPs do not grant permissions on their own; IAM must allow the desired operation; that caveat is associated more closely with AWS Organizations SCP for the need to establish maximum account permissions across an AWS organization than with AWS Firewall Manager centralized policies for the requirement to apply supported firewall protections consistently across multiple AWS accounts.

Certificate management is distinct from encrypting database files at rest; that caveat is associated more closely with AWS Certificate Manager TLS certificates for the need to provision and manage certificates for supported TLS endpoints than with AWS Firewall Manager centralized policies for the requirement to apply supported firewall protections consistently across multiple AWS accounts.

Amazon Macie primarily supports the earlier need to identify potentially sensitive data stored in Amazon S3 because macie discovers and classifies sensitive information in supported S3 data, but the new task is to use dedicated hardware modules with direct cryptographic control; that is why AWS CloudHSM is preferable here.

AWS WAF managed rule groups is intended to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints; in this design the new outcome is to use dedicated hardware modules with direct cryptographic control, which calls for AWS CloudHSM rather than AWS WAF managed rule groups or the earlier Amazon Macie.

AWS KMS is intended to manage cryptographic keys and their authorized use in AWS services because kMS integrates managed keys with many AWS encryption workflows; in this design the new outcome is to use dedicated hardware modules with direct cryptographic control, which calls for AWS CloudHSM rather than AWS KMS or the earlier Amazon Macie.

Temporary session credentials primarily supports the earlier need to avoid long-lived application secrets when making authorized AWS requests because temporary credentials expire and can be issued through IAM roles and federation, but the new task is to provide temporary access to a trusted principal or AWS workload; that is why IAM role temporary credentials is preferable here.

AWS Organizations member-account guardrails is intended to restrict maximum access by applying organizational policies because organization-level policies can constrain member accounts regardless of broader IAM allows; in this design the new outcome is to provide temporary access to a trusted principal or AWS workload, which calls for IAM role temporary credentials rather than AWS Organizations member-account guardrails or the earlier Temporary session credentials.

Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to provide temporary access to a trusted principal or AWS workload, which calls for IAM role temporary credentials rather than Amazon Cognito identity pools or the earlier Temporary session credentials.

AWS S3 infrastructure availability primarily supports the earlier need to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3, but the new task is to identify who maintains the independent infrastructure underlying Availability Zones; that is why AWS regional facility redundancy is preferable here.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who maintains the independent infrastructure underlying Availability Zones, which calls for AWS regional facility redundancy rather than Customer application patching on EC2 or the earlier AWS S3 infrastructure availability.

Customer RDS access controls is intended to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; in this design the new outcome is to identify who maintains the independent infrastructure underlying Availability Zones, which calls for AWS regional facility redundancy rather than Customer RDS access controls or the earlier AWS S3 infrastructure availability.

Data-residency region choice primarily supports the earlier need to select a deployment geography to meet an organization's data-location requirements because customers can select supported Regions and understand where service data is processed or stored, but the new task is to verify whether a required service and control are available in the chosen AWS Region; that is why Regional service eligibility is preferable here.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to verify whether a required service and control are available in the chosen AWS Region, which calls for Regional service eligibility rather than AWS KMS managed keys or the earlier Data-residency region choice.

Amazon CloudWatch metrics is intended to observe resource utilization and service performance over time because cloudWatch gathers metrics, alarms and logs for operational monitoring; in this design the new outcome is to verify whether a required service and control are available in the chosen AWS Region, which calls for Regional service eligibility rather than Amazon CloudWatch metrics or the earlier Data-residency region choice.

That description belongs to AWS Well-Architected Tool because the Well-Architected Tool provides structured questions and improvement recommendations; it is used to review a workload against architectural best practices including security, not to explain how AWS Security Blog provides the function to read AWS-authored security guidance, news and technical practices.

That description belongs to AWS Security Center because AWS security portals collect information about AWS cloud security capabilities; it is used to find AWS security resources and information in one place, not to explain how AWS Security Blog provides the function to read AWS-authored security guidance, news and technical practices.

That description belongs to AWS Knowledge Center because the Knowledge Center provides support-style articles about known issues and features; it is used to find answers to common AWS technical and security questions, not to explain how AWS Security Blog provides the function to read AWS-authored security guidance, news and technical practices.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to identify who maintains the virtualization host beneath an EC2 instance, which calls for AWS hypervisor maintenance rather than Customer EC2 guest OS patching or the earlier AWS managed RDS infrastructure.

Customer RDS access controls is intended to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; in this design the new outcome is to identify who maintains the virtualization host beneath an EC2 instance, which calls for AWS hypervisor maintenance rather than Customer RDS access controls or the earlier AWS managed RDS infrastructure.

AWS managed RDS infrastructure primarily supports the earlier need to identify who handles the underlying operating system for an Amazon RDS DB instance because AWS operates the managed database platform and underlying host maintenance for RDS, but the new task is to identify who maintains the virtualization host beneath an EC2 instance; that is why AWS hypervisor maintenance is preferable here.

Amazon Cognito user pools is intended to support sign-up and authentication of application end users because cognito user pools provide user directories and authentication features for apps; in this design the new outcome is to add a second authentication factor to protect interactive sign-in, which calls for Multi-factor authentication (MFA) rather than Amazon Cognito user pools or the earlier Inline IAM policy.

Inline IAM policy primarily supports the earlier need to bind a permissions policy directly to one identity rather than sharing it because an inline policy maintains a one-to-one association with an IAM user, group or role, but the new task is to add a second authentication factor to protect interactive sign-in; that is why Multi-factor authentication (MFA) is preferable here.

IAM user is intended to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions; in this design the new outcome is to add a second authentication factor to protect interactive sign-in, which calls for Multi-factor authentication (MFA) rather than IAM user or the earlier Inline IAM policy.

Amazon Macie sensitive-data discovery primarily supports the earlier need to locate sensitive information such as personal data in Amazon S3 because macie uses machine learning and pattern matching to discover sensitive data in S3, but the new task is to record selected IP network-flow information for VPC resources; that is why Amazon VPC Flow Logs traffic metadata is preferable here.

Access analysis is intended to find unintended external or broad permissions on AWS resources because IAM Access Analyzer can help identify supported resources shared with external principals and analyze access; in this design the new outcome is to record selected IP network-flow information for VPC resources, which calls for Amazon VPC Flow Logs traffic metadata rather than Access analysis or the earlier Amazon Macie sensitive-data discovery.

Encryption at rest is intended to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure; in this design the new outcome is to record selected IP network-flow information for VPC resources, which calls for Amazon VPC Flow Logs traffic metadata rather than Encryption at rest or the earlier Amazon Macie sensitive-data discovery.