Amazon Macie sensitive-data discovery primarily supports the earlier need to locate sensitive information such as personal data in Amazon S3 because macie uses machine learning and pattern matching to discover sensitive data in S3, but the new task is to record selected IP network-flow information for VPC resources; that is why Amazon VPC Flow Logs traffic metadata is preferable here.

Access analysis is intended to find unintended external or broad permissions on AWS resources because IAM Access Analyzer can help identify supported resources shared with external principals and analyze access; in this design the new outcome is to record selected IP network-flow information for VPC resources, which calls for Amazon VPC Flow Logs traffic metadata rather than Access analysis or the earlier Amazon Macie sensitive-data discovery.

Encryption at rest is intended to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure; in this design the new outcome is to record selected IP network-flow information for VPC resources, which calls for Amazon VPC Flow Logs traffic metadata rather than Encryption at rest or the earlier Amazon Macie sensitive-data discovery.

Amazon CloudWatch metrics primarily supports the earlier need to observe resource utilization and service performance over time because cloudWatch gathers metrics, alarms and logs for operational monitoring, but the new task is to use AWS audited infrastructure controls as supporting evidence; that is why AWS service compliance inheritance is preferable here.

AWS Control Tower landing zone is intended to establish governed multi-account environments with standardized controls because control Tower orchestrates a landing zone with account governance and guardrails; in this design the new outcome is to use AWS audited infrastructure controls as supporting evidence, which calls for AWS service compliance inheritance rather than AWS Control Tower landing zone or the earlier Amazon CloudWatch metrics.

AWS Audit Manager evidence collection is intended to organize evidence of AWS usage for audit assessments because audit Manager helps collect and organize evidence against control frameworks; in this design the new outcome is to use AWS audited infrastructure controls as supporting evidence, which calls for AWS service compliance inheritance rather than AWS Audit Manager evidence collection or the earlier Amazon CloudWatch metrics.

Database platform management does not decide which application users deserve access; that caveat is associated more closely with Customer RDS access controls for the need to identify who sets database credentials and network exposure for an RDS workload than with AWS hardware lifecycle for the requirement to identify who replaces failed drives and server components in AWS facilities.

AWS operates the platform, but does not set application-specific least-privilege rules for customers; that caveat is associated more closely with Customer EC2 security groups for the need to decide who configures firewall rules around a customer instance than with AWS hardware lifecycle for the requirement to identify who replaces failed drives and server components in AWS facilities.

Infrastructure maintenance by AWS is not a substitute for application security fixes; that caveat is associated more closely with Customer application patching on EC2 for the need to determine who updates software installed by a customer on an EC2 VM than with AWS hardware lifecycle for the requirement to identify who replaces failed drives and server components in AWS facilities.

AWS Knowledge Center is intended to find answers to common AWS technical and security questions because the Knowledge Center provides support-style articles about known issues and features; in this design the new outcome is to review a workload against architectural best practices including security, which calls for AWS Well-Architected Tool rather than AWS Knowledge Center or the earlier AWS Security Center.

AWS Marketplace security solutions is intended to obtain eligible third-party security software through AWS Marketplace because marketplace offers third-party and AWS software listings for procurement and deployment; in this design the new outcome is to review a workload against architectural best practices including security, which calls for AWS Well-Architected Tool rather than AWS Marketplace security solutions or the earlier AWS Security Center.

AWS Security Center primarily supports the earlier need to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities, but the new task is to review a workload against architectural best practices including security; that is why AWS Well-Architected Tool is preferable here.

IAM role temporary credentials is intended to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; in this design the new outcome is to restrict maximum access by applying organizational policies, which calls for AWS Organizations member-account guardrails rather than IAM role temporary credentials or the earlier IAM user.

IAM user primarily supports the earlier need to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions, but the new task is to restrict maximum access by applying organizational policies; that is why AWS Organizations member-account guardrails is preferable here.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to restrict maximum access by applying organizational policies, which calls for AWS Organizations member-account guardrails rather than IAM Identity Center external directory or the earlier IAM user.

Centralized security logging addresses the separate need to retain and correlate audit records from multiple accounts because central collection helps security staff investigate activity without relying on individual workloads; it is not as direct as Security incident response planning for the actual requirement to prepare containment, investigation and recovery processes before an incident.

AWS Security Hub centralized findings addresses the separate need to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; it is not as direct as Security incident response planning for the actual requirement to prepare containment, investigation and recovery processes before an incident.

AWS Organizations SCP addresses the separate need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; it is not as direct as Security incident response planning for the actual requirement to prepare containment, investigation and recovery processes before an incident.

That description belongs to IAM Identity Center workforce access because IAM Identity Center supports workforce federation and permission-set based access; it is used to centralize human access to multiple AWS accounts and supported applications, not to explain how IAM resource-based policy provides the function to grant access through a policy attached to a supported resource.

That description belongs to IAM permissions boundary because a permissions boundary acts as a ceiling on effective identity-based permissions; it is used to limit the maximum permissions an identity policy can grant to a user or role, not to explain how IAM resource-based policy provides the function to grant access through a policy attached to a supported resource.

That description belongs to IAM Access Analyzer policy validation because policy validation analyzes IAM policy documents for issues and best-practice findings; it is used to identify policy errors and security warnings before broad access is granted, not to explain how IAM resource-based policy provides the function to grant access through a policy attached to a supported resource.

AWS CloudTrail is intended to investigate account actions and API activity relevant to a security event because cloudTrail supplies audit records of supported management events; in this design the new outcome is to investigate relationships and context around suspicious activity, which calls for Amazon Detective rather than AWS CloudTrail or the earlier Amazon GuardDuty.

Amazon GuardDuty primarily supports the earlier need to surface suspicious activity using threat intelligence and anomaly analysis because guardDuty detects potential security threats from supported AWS signals, but the new task is to investigate relationships and context around suspicious activity; that is why Amazon Detective is preferable here.

AWS WAF managed rule groups is intended to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints; in this design the new outcome is to investigate relationships and context around suspicious activity, which calls for Amazon Detective rather than AWS WAF managed rule groups or the earlier Amazon GuardDuty.

Customer EC2 guest OS patching addresses the separate need to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; it is not as direct as Customer compliance obligations for the actual requirement to determine who ensures application use and data handling meet the customer's regulations.

Customer Lambda function code addresses the separate need to identify who writes and secures the application logic of a Lambda function because customers own the code, dependencies and identity permissions they provide to a Lambda function; it is not as direct as Customer compliance obligations for the actual requirement to determine who ensures application use and data handling meet the customer's regulations.

Customer application patching on EC2 addresses the separate need to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; it is not as direct as Customer compliance obligations for the actual requirement to determine who ensures application use and data handling meet the customer's regulations.

AWS KMS managed keys addresses the separate need to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; it is not as direct as AWS Organizations SCP for the actual requirement to establish maximum account permissions across an AWS organization.

AWS Certificate Manager TLS certificates addresses the separate need to provision and manage certificates for supported TLS endpoints because aCM manages public or imported certificates for use with integrated services; it is not as direct as AWS Organizations SCP for the actual requirement to establish maximum account permissions across an AWS organization.

AWS Firewall Manager centralized policies addresses the separate need to apply supported firewall protections consistently across multiple AWS accounts because firewall Manager provides central policy management for protections such as WAF and Shield-related configurations; it is not as direct as AWS Organizations SCP for the actual requirement to establish maximum account permissions across an AWS organization.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to decide who grants access permissions to customer data and AWS resources, which calls for Customer IAM permission design rather than AWS S3 infrastructure availability or the earlier Customer compliance obligations.

Customer compliance obligations primarily supports the earlier need to determine who ensures application use and data handling meet the customer's regulations because customers remain responsible for their legal obligations, data usage and service configurations, but the new task is to decide who grants access permissions to customer data and AWS resources; that is why Customer IAM permission design is preferable here.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to decide who grants access permissions to customer data and AWS resources, which calls for Customer IAM permission design rather than Customer EC2 guest OS patching or the earlier Customer compliance obligations.