Encryption in transit addresses the separate need to protect information while it travels over a network because tLS and similar protocols help secure data exchanged between clients and services; it is not as direct as AWS Trusted Advisor security checks for the actual requirement to review common security and configuration recommendations in AWS accounts.

AWS Config configuration history addresses the separate need to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules; it is not as direct as AWS Trusted Advisor security checks for the actual requirement to review common security and configuration recommendations in AWS accounts.

AWS Organizations SCP addresses the separate need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; it is not as direct as AWS Trusted Advisor security checks for the actual requirement to review common security and configuration recommendations in AWS accounts.

Customer IAM permission design addresses the separate need to decide who grants access permissions to customer data and AWS resources because customers create access rules and identities suited to organizational least-privilege requirements; it is not as direct as Customer EC2 security groups for the actual requirement to decide who configures firewall rules around a customer instance.

Customer VPC network design addresses the separate need to determine who selects subnets, routes and exposure within a VPC because customers design and configure their isolated network environment on AWS; it is not as direct as Customer EC2 security groups for the actual requirement to decide who configures firewall rules around a customer instance.

AWS S3 infrastructure availability addresses the separate need to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; it is not as direct as Customer EC2 security groups for the actual requirement to decide who configures firewall rules around a customer instance.

Predefined policies can be broader than an application-specific least-privilege design; that caveat is associated more closely with AWS managed IAM policies for the need to use a predefined AWS-maintained permissions policy when its scope is appropriate than with IAM group for the requirement to manage similar IAM user permissions through group membership.

Access keys are not a substitute for MFA-protected console access when interactive login is needed; that caveat is associated more closely with IAM access keys for the need to authorize programmatic AWS API access for a permitted IAM principal than with IAM group for the requirement to manage similar IAM user permissions through group membership.

Not all AWS services support identical policy types or cross-account behavior; that caveat is associated more closely with IAM resource-based policy for the need to grant access through a policy attached to a supported resource than with IAM group for the requirement to manage similar IAM user permissions through group membership.

AWS Security Blog is intended to read AWS-authored security guidance, news and technical practices because the AWS Security Blog publishes security-focused articles and examples; in this design the new outcome is to review common security and configuration opportunities alongside operational checks, which calls for AWS Trusted Advisor rather than AWS Security Blog or the earlier AWS Security Center.

AWS WAF managed rule groups is intended to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints; in this design the new outcome is to review common security and configuration opportunities alongside operational checks, which calls for AWS Trusted Advisor rather than AWS WAF managed rule groups or the earlier AWS Security Center.

AWS Security Center primarily supports the earlier need to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities, but the new task is to review common security and configuration opportunities alongside operational checks; that is why AWS Trusted Advisor is preferable here.

AWS CloudTrail event history primarily supports the earlier need to review who invoked AWS management API actions in an account because cloudTrail records AWS account API activity and supports investigation of management actions, but the new task is to share supported AWS resources across accounts in a controlled way; that is why AWS Resource Access Manager sharing is preferable here.

AWS Certificate Manager TLS certificates is intended to provision and manage certificates for supported TLS endpoints because aCM manages public or imported certificates for use with integrated services; in this design the new outcome is to share supported AWS resources across accounts in a controlled way, which calls for AWS Resource Access Manager sharing rather than AWS Certificate Manager TLS certificates or the earlier AWS CloudTrail event history.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to share supported AWS resources across accounts in a controlled way, which calls for AWS Resource Access Manager sharing rather than AWS KMS managed keys or the earlier AWS CloudTrail event history.

That description belongs to Customer S3 bucket policy because customers own S3 authorization configuration such as bucket policies and access settings; it is used to decide who restricts public or cross-account access to stored objects, not to explain how Customer logging and retention settings provides the function to decide who enables appropriate activity logging and keeps records as required.

That description belongs to Customer IAM permission design because customers create access rules and identities suited to organizational least-privilege requirements; it is used to decide who grants access permissions to customer data and AWS resources, not to explain how Customer logging and retention settings provides the function to decide who enables appropriate activity logging and keeps records as required.

That description belongs to Customer EC2 security groups because customers choose inbound and outbound security-group permissions for their resources; it is used to decide who configures firewall rules around a customer instance, not to explain how Customer logging and retention settings provides the function to decide who enables appropriate activity logging and keeps records as required.

Amazon Macie addresses the separate need to identify potentially sensitive data stored in Amazon S3 because macie discovers and classifies sensitive information in supported S3 data; it is not as direct as AWS WAF managed rule groups for the actual requirement to apply common web-request protection patterns using maintained rules.

AWS Secrets Manager addresses the separate need to securely store supported credentials and coordinate secret rotation because secrets Manager reduces the need to embed passwords and tokens in application source code; it is not as direct as AWS WAF managed rule groups for the actual requirement to apply common web-request protection patterns using maintained rules.

AWS Security Center addresses the separate need to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; it is not as direct as AWS WAF managed rule groups for the actual requirement to apply common web-request protection patterns using maintained rules.

AWS Config configuration history primarily supports the earlier need to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules, but the new task is to review common security and configuration recommendations in AWS accounts; that is why AWS Trusted Advisor security checks is preferable here.

AWS Config rules is intended to evaluate a configuration against a defined compliance requirement because config rules assess resource settings such as encryption or approved configuration states; in this design the new outcome is to review common security and configuration recommendations in AWS accounts, which calls for AWS Trusted Advisor security checks rather than AWS Config rules or the earlier AWS Config configuration history.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to review common security and configuration recommendations in AWS accounts, which calls for AWS Trusted Advisor security checks rather than AWS Security Hub centralized findings or the earlier AWS Config configuration history.

That description belongs to IAM access keys because an access key ID and secret key can sign API requests but require careful protection and rotation; it is used to authorize programmatic AWS API access for a permitted IAM principal, not to explain how Password policy provides the function to set complexity and lifetime requirements for applicable IAM user passwords.

That description belongs to IAM group because an IAM group is a collection of IAM users that can share attached permissions policies; it is used to manage similar IAM user permissions through group membership, not to explain how Password policy provides the function to set complexity and lifetime requirements for applicable IAM user passwords.

That description belongs to IAM credential report because IAM credential reports summarize credential status for IAM users in an account; it is used to audit account IAM user credentials and their usage properties, not to explain how Password policy provides the function to set complexity and lifetime requirements for applicable IAM user passwords.

AWS KMS addresses the separate need to manage cryptographic keys and their authorized use in AWS services because kMS integrates managed keys with many AWS encryption workflows; it is not as direct as AWS CloudHSM for the actual requirement to use dedicated hardware modules with direct cryptographic control.

AWS Artifact addresses the separate need to retrieve third-party compliance reports relevant to AWS-operated controls because artifact makes AWS assurance materials accessible for compliance teams; it is not as direct as AWS CloudHSM for the actual requirement to use dedicated hardware modules with direct cryptographic control.

AWS IAM Access Analyzer addresses the separate need to detect external sharing and analyze access policies for supported resources because access Analyzer produces findings and policy analysis that aid least-privilege reviews; it is not as direct as AWS CloudHSM for the actual requirement to use dedicated hardware modules with direct cryptographic control.

IAM policy condition is intended to limit authorized requests using context such as MFA, source or tags where supported because IAM policy conditions refine when an allow or deny statement applies; in this design the new outcome is to avoid long-lived application secrets when making authorized AWS requests, which calls for Temporary session credentials rather than IAM policy condition or the earlier IAM user.

AWS Secrets Manager is intended to store and rotate supported application secrets without hard-coding them because secrets Manager stores protected secrets and supports rotation workflows; in this design the new outcome is to avoid long-lived application secrets when making authorized AWS requests, which calls for Temporary session credentials rather than AWS Secrets Manager or the earlier IAM user.

IAM user primarily supports the earlier need to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions, but the new task is to avoid long-lived application secrets when making authorized AWS requests; that is why Temporary session credentials is preferable here.