AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to decide who grants access permissions to customer data and AWS resources, which calls for Customer IAM permission design rather than AWS S3 infrastructure availability or the earlier Customer compliance obligations.

Customer compliance obligations primarily supports the earlier need to determine who ensures application use and data handling meet the customer's regulations because customers remain responsible for their legal obligations, data usage and service configurations, but the new task is to decide who grants access permissions to customer data and AWS resources; that is why Customer IAM permission design is preferable here.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to decide who grants access permissions to customer data and AWS resources, which calls for Customer IAM permission design rather than Customer EC2 guest OS patching or the earlier Customer compliance obligations.

IAM permissions boundary addresses the separate need to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions; it is not as direct as IAM resource-based policy for the actual requirement to grant access through a policy attached to a supported resource.

IAM Identity Center external directory addresses the separate need to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; it is not as direct as IAM resource-based policy for the actual requirement to grant access through a policy attached to a supported resource.

IAM role temporary credentials addresses the separate need to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is not as direct as IAM resource-based policy for the actual requirement to grant access through a policy attached to a supported resource.

That description belongs to AWS KMS because kMS integrates managed keys with many AWS encryption workflows; it is used to manage cryptographic keys and their authorized use in AWS services, not to explain how AWS Certificate Manager provides the function to manage TLS certificates for integrated AWS applications.

That description belongs to AWS WAF managed rule groups because managed rule groups provide ready-to-use WAF rules for supported web endpoints; it is used to apply common web-request protection patterns using maintained rules, not to explain how AWS Certificate Manager provides the function to manage TLS certificates for integrated AWS applications.

That description belongs to AWS Shield Standard because shield Standard supplies automatic DDoS protection to supported resources; it is used to provide baseline DDoS protections for supported AWS resources, not to explain how AWS Certificate Manager provides the function to manage TLS certificates for integrated AWS applications.

IAM credential report addresses the separate need to audit account IAM user credentials and their usage properties because IAM credential reports summarize credential status for IAM users in an account; it is not as direct as IAM permissions boundary for the actual requirement to limit the maximum permissions an identity policy can grant to a user or role.

Service-linked IAM role addresses the separate need to delegate service-specific operations to an AWS service under a defined role because service-linked roles are tied to AWS services and have constrained predefined service purposes; it is not as direct as IAM permissions boundary for the actual requirement to limit the maximum permissions an identity policy can grant to a user or role.

IAM policy condition addresses the separate need to limit authorized requests using context such as MFA, source or tags where supported because IAM policy conditions refine when an allow or deny statement applies; it is not as direct as IAM permissions boundary for the actual requirement to limit the maximum permissions an identity policy can grant to a user or role.

AWS KMS managed keys addresses the separate need to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; it is not as direct as Encryption in transit for the actual requirement to protect information while it travels over a network.

AWS Config configuration history addresses the separate need to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules; it is not as direct as Encryption in transit for the actual requirement to protect information while it travels over a network.

Security posture evaluation addresses the separate need to identify departures from approved secure configuration baselines because posture tools and configuration checks compare resource settings against security standards; it is not as direct as Encryption in transit for the actual requirement to protect information while it travels over a network.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to read AWS-authored security guidance, news and technical practices, which calls for AWS Security Blog rather than AWS Security Center or the earlier AWS Well-Architected Tool.

AWS Well-Architected Tool primarily supports the earlier need to review a workload against architectural best practices including security because the Well-Architected Tool provides structured questions and improvement recommendations, but the new task is to read AWS-authored security guidance, news and technical practices; that is why AWS Security Blog is preferable here.

AWS Security Hub is intended to review centralized security posture and findings from multiple sources because security Hub consolidates and prioritizes findings across AWS security services; in this design the new outcome is to read AWS-authored security guidance, news and technical practices, which calls for AWS Security Blog rather than AWS Security Hub or the earlier AWS Well-Architected Tool.

Customer EC2 security groups addresses a different objective, to decide who configures firewall rules around a customer instance, because customers choose inbound and outbound security-group permissions for their resources; the checklist instead requires the distinct outcomes to decide who grants access permissions to customer data and AWS resources; recognize how patch duties differ between provider hosts and customer-managed instances.

AWS Lambda compute platform addresses a different objective, to identify who operates the physical and service infrastructure for Lambda execution, because AWS runs and scales the underlying Lambda compute service and manages its infrastructure; the checklist instead requires the distinct outcomes to decide who grants access permissions to customer data and AWS resources; recognize how patch duties differ between provider hosts and customer-managed instances.

Customer backup policy selection addresses a different objective, to determine who chooses recovery retention and frequency for business workloads, because customers establish data recovery objectives and configure suitable backups or managed-service settings; the checklist instead requires the distinct outcomes to decide who grants access permissions to customer data and AWS resources; recognize how patch duties differ between provider hosts and customer-managed instances.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to investigate account actions and API activity relevant to a security event, which calls for AWS CloudTrail rather than AWS Security Center or the earlier AWS Trusted Advisor.

AWS Trusted Advisor primarily supports the earlier need to review common security and configuration opportunities alongside operational checks because trusted Advisor provides best-practice checks in several categories, but the new task is to investigate account actions and API activity relevant to a security event; that is why AWS CloudTrail is preferable here.

AWS Knowledge Center is intended to find answers to common AWS technical and security questions because the Knowledge Center provides support-style articles about known issues and features; in this design the new outcome is to investigate account actions and API activity relevant to a security event, which calls for AWS CloudTrail rather than AWS Knowledge Center or the earlier AWS Trusted Advisor.

Amazon GuardDuty threat detection primarily supports the earlier need to detect suspicious account or workload behavior from security signals because guardDuty analyzes supported event and telemetry sources to identify potential malicious activity, but the new task is to prepare containment, investigation and recovery processes before an incident; that is why Security incident response planning is preferable here.

AWS CloudTrail event history is intended to review who invoked AWS management API actions in an account because cloudTrail records AWS account API activity and supports investigation of management actions; in this design the new outcome is to prepare containment, investigation and recovery processes before an incident, which calls for Security incident response planning rather than AWS CloudTrail event history or the earlier Amazon GuardDuty threat detection.

AWS Artifact compliance reports is intended to obtain AWS third-party compliance reports and contractual documents because artifact provides self-service access to selected AWS compliance documentation and agreements; in this design the new outcome is to prepare containment, investigation and recovery processes before an incident, which calls for Security incident response planning rather than AWS Artifact compliance reports or the earlier Amazon GuardDuty threat detection.

That description belongs to IAM group because an IAM group is a collection of IAM users that can share attached permissions policies; it is used to manage similar IAM user permissions through group membership, not to explain how IAM credential report provides the function to audit account IAM user credentials and their usage properties.

That description belongs to Password policy because account password policy governs certain IAM user console passwords; it is used to set complexity and lifetime requirements for applicable IAM user passwords, not to explain how IAM credential report provides the function to audit account IAM user credentials and their usage properties.

That description belongs to IAM user because IAM users are identities defined within an AWS account with configurable permissions; it is used to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate, not to explain how IAM credential report provides the function to audit account IAM user credentials and their usage properties.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who handles the underlying operating system for an Amazon RDS DB instance, which calls for AWS managed RDS infrastructure rather than Customer application patching on EC2 or the earlier Customer RDS access controls.

Customer RDS access controls primarily supports the earlier need to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used, but the new task is to identify who handles the underlying operating system for an Amazon RDS DB instance; that is why AWS managed RDS infrastructure is preferable here.

AWS global network infrastructure is intended to determine who operates the provider-owned physical networking fabric because AWS manages its worldwide network infrastructure and physical connectivity within its facilities; in this design the new outcome is to identify who handles the underlying operating system for an Amazon RDS DB instance, which calls for AWS managed RDS infrastructure rather than AWS global network infrastructure or the earlier Customer RDS access controls.