IAM policy condition is intended to limit authorized requests using context such as MFA, source or tags where supported because IAM policy conditions refine when an allow or deny statement applies; in this design the new outcome is to avoid long-lived application secrets when making authorized AWS requests, which calls for Temporary session credentials rather than IAM policy condition or the earlier IAM user.

AWS Secrets Manager is intended to store and rotate supported application secrets without hard-coding them because secrets Manager stores protected secrets and supports rotation workflows; in this design the new outcome is to avoid long-lived application secrets when making authorized AWS requests, which calls for Temporary session credentials rather than AWS Secrets Manager or the earlier IAM user.

IAM user primarily supports the earlier need to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions, but the new task is to avoid long-lived application secrets when making authorized AWS requests; that is why Temporary session credentials is preferable here.

Customer S3 bucket policy addresses the separate need to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; it is not as direct as Shared patch-management responsibility for the actual requirement to recognize how patch duties differ between provider hosts and customer-managed instances.

Customer Lambda function code addresses the separate need to identify who writes and secures the application logic of a Lambda function because customers own the code, dependencies and identity permissions they provide to a Lambda function; it is not as direct as Shared patch-management responsibility for the actual requirement to recognize how patch duties differ between provider hosts and customer-managed instances.

AWS hypervisor maintenance addresses the separate need to identify who maintains the virtualization host beneath an EC2 instance because AWS manages the host operating environment and virtualization components for EC2; it is not as direct as Shared patch-management responsibility for the actual requirement to recognize how patch duties differ between provider hosts and customer-managed instances.

Customer RDS access controls addresses the separate need to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; it is not as direct as Shared patch-management responsibility for the actual requirement to recognize how patch duties differ between provider hosts and customer-managed instances.

That description belongs to Amazon CloudWatch metrics because cloudWatch gathers metrics, alarms and logs for operational monitoring; it is used to observe resource utilization and service performance over time, not to explain how Separation of duties provides the function to prevent one principal from controlling incompatible business functions.

That description belongs to AWS CloudTrail event history because cloudTrail records AWS account API activity and supports investigation of management actions; it is used to review who invoked AWS management API actions in an account, not to explain how Separation of duties provides the function to prevent one principal from controlling incompatible business functions.

That description belongs to AWS Artifact compliance reports because artifact provides self-service access to selected AWS compliance documentation and agreements; it is used to obtain AWS third-party compliance reports and contractual documents, not to explain how Separation of duties provides the function to prevent one principal from controlling incompatible business functions.

AWS Trusted Advisor addresses a different objective, to review common security and configuration opportunities alongside operational checks, because trusted Advisor provides best-practice checks in several categories; the checklist instead requires the distinct outcomes to investigate relationships and context around suspicious activity; provide baseline DDoS protections for supported AWS resources.

AWS KMS addresses a different objective, to manage cryptographic keys and their authorized use in AWS services, because kMS integrates managed keys with many AWS encryption workflows; the checklist instead requires the distinct outcomes to investigate relationships and context around suspicious activity; provide baseline DDoS protections for supported AWS resources.

AWS WAF managed rule groups addresses a different objective, to apply common web-request protection patterns using maintained rules, because managed rule groups provide ready-to-use WAF rules for supported web endpoints; the checklist instead requires the distinct outcomes to investigate relationships and context around suspicious activity; provide baseline DDoS protections for supported AWS resources.

IAM permissions boundary addresses a different objective, to limit the maximum permissions an identity policy can grant to a user or role, because a permissions boundary acts as a ceiling on effective identity-based permissions; the checklist instead requires the distinct outcomes to store configuration parameters and selected secrets for applications; reduce exposure of the AWS account's highly privileged root identity.

IAM Identity Center external directory addresses a different objective, to integrate existing workforce identities with AWS account access, because identity Center can work with supported external identity sources for centralized access; the checklist instead requires the distinct outcomes to store configuration parameters and selected secrets for applications; reduce exposure of the AWS account's highly privileged root identity.

Federated identity access addresses a different objective, to let an existing external identity provider authenticate users for AWS access, because federation allows trusted identities to receive AWS access without separate IAM user passwords; the checklist instead requires the distinct outcomes to store configuration parameters and selected secrets for applications; reduce exposure of the AWS account's highly privileged root identity.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to determine who selects subnets, routes and exposure within a VPC, which calls for Customer VPC network design rather than Customer EC2 guest OS patching or the earlier AWS global network infrastructure.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to determine who selects subnets, routes and exposure within a VPC, which calls for Customer VPC network design rather than AWS S3 infrastructure availability or the earlier AWS global network infrastructure.

AWS global network infrastructure primarily supports the earlier need to determine who operates the provider-owned physical networking fabric because AWS manages its worldwide network infrastructure and physical connectivity within its facilities, but the new task is to determine who selects subnets, routes and exposure within a VPC; that is why Customer VPC network design is preferable here.

AWS Trusted Advisor security checks is intended to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost; in this design the new outcome is to review who invoked AWS management API actions in an account, which calls for AWS CloudTrail event history rather than AWS Trusted Advisor security checks or the earlier AWS Config configuration history.

AWS Config configuration history primarily supports the earlier need to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules, but the new task is to review who invoked AWS management API actions in an account; that is why AWS CloudTrail event history is preferable here.

AWS Organizations SCP is intended to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; in this design the new outcome is to review who invoked AWS management API actions in an account, which calls for AWS CloudTrail event history rather than AWS Organizations SCP or the earlier AWS Config configuration history.

That description belongs to AWS Well-Architected Tool because the Well-Architected Tool provides structured questions and improvement recommendations; it is used to review a workload against architectural best practices including security, not to explain how AWS Security Hub provides the function to review centralized security posture and findings from multiple sources.

That description belongs to AWS Knowledge Center because the Knowledge Center provides support-style articles about known issues and features; it is used to find answers to common AWS technical and security questions, not to explain how AWS Security Hub provides the function to review centralized security posture and findings from multiple sources.

That description belongs to AWS Trusted Advisor because trusted Advisor provides best-practice checks in several categories; it is used to review common security and configuration opportunities alongside operational checks, not to explain how AWS Security Hub provides the function to review centralized security posture and findings from multiple sources.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to decide who grants access permissions to customer data and AWS resources, which calls for Customer IAM permission design rather than Customer EC2 guest OS patching or the earlier Customer encryption configuration.

Customer encryption configuration primarily supports the earlier need to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection, but the new task is to decide who grants access permissions to customer data and AWS resources; that is why Customer IAM permission design is preferable here.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to decide who grants access permissions to customer data and AWS resources, which calls for Customer IAM permission design rather than AWS S3 infrastructure availability or the earlier Customer encryption configuration.

AWS Config configuration history primarily supports the earlier need to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules, but the new task is to locate sensitive information such as personal data in Amazon S3; that is why Amazon Macie sensitive-data discovery is preferable here.

Encryption in transit is intended to protect information while it travels over a network because tLS and similar protocols help secure data exchanged between clients and services; in this design the new outcome is to locate sensitive information such as personal data in Amazon S3, which calls for Amazon Macie sensitive-data discovery rather than Encryption in transit or the earlier AWS Config configuration history.

Encryption at rest is intended to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure; in this design the new outcome is to locate sensitive information such as personal data in Amazon S3, which calls for Amazon Macie sensitive-data discovery rather than Encryption at rest or the earlier AWS Config configuration history.

That description belongs to IAM role trust policy because a role trust policy controls the trusted entities for role assumption; it is used to define which principals are allowed to assume a specific role, not to explain how IAM role permissions policy provides the function to define which AWS operations a successfully assumed role can perform.

That description belongs to Service-linked IAM role because service-linked roles are tied to AWS services and have constrained predefined service purposes; it is used to delegate service-specific operations to an AWS service under a defined role, not to explain how IAM role permissions policy provides the function to define which AWS operations a successfully assumed role can perform.

That description belongs to IAM identity-based policy because identity-based policies attach to users, groups or roles and express allowed or denied actions; it is used to define what actions an IAM principal may perform on specified resources, not to explain how IAM role permissions policy provides the function to define which AWS operations a successfully assumed role can perform.