That description belongs to IAM role trust policy because a role trust policy controls the trusted entities for role assumption; it is used to define which principals are allowed to assume a specific role, not to explain how IAM role permissions policy provides the function to define which AWS operations a successfully assumed role can perform.

That description belongs to Service-linked IAM role because service-linked roles are tied to AWS services and have constrained predefined service purposes; it is used to delegate service-specific operations to an AWS service under a defined role, not to explain how IAM role permissions policy provides the function to define which AWS operations a successfully assumed role can perform.

That description belongs to IAM identity-based policy because identity-based policies attach to users, groups or roles and express allowed or denied actions; it is used to define what actions an IAM principal may perform on specified resources, not to explain how IAM role permissions policy provides the function to define which AWS operations a successfully assumed role can perform.

AWS KMS addresses a different objective, to manage cryptographic keys and their authorized use in AWS services, because kMS integrates managed keys with many AWS encryption workflows; the checklist instead requires the distinct outcomes to find AWS security resources and information in one place; identify potentially sensitive data stored in Amazon S3.

AWS Security Hub addresses a different objective, to review centralized security posture and findings from multiple sources, because security Hub consolidates and prioritizes findings across AWS security services; the checklist instead requires the distinct outcomes to find AWS security resources and information in one place; identify potentially sensitive data stored in Amazon S3.

AWS IAM Access Analyzer addresses a different objective, to detect external sharing and analyze access policies for supported resources, because access Analyzer produces findings and policy analysis that aid least-privilege reviews; the checklist instead requires the distinct outcomes to find AWS security resources and information in one place; identify potentially sensitive data stored in Amazon S3.

IAM access keys addresses the separate need to authorize programmatic AWS API access for a permitted IAM principal because an access key ID and secret key can sign API requests but require careful protection and rotation; it is not as direct as IAM Identity Center workforce access for the actual requirement to centralize human access to multiple AWS accounts and supported applications.

IAM role temporary credentials addresses the separate need to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is not as direct as IAM Identity Center workforce access for the actual requirement to centralize human access to multiple AWS accounts and supported applications.

IAM Identity Center external directory addresses the separate need to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; it is not as direct as IAM Identity Center workforce access for the actual requirement to centralize human access to multiple AWS accounts and supported applications.

IAM Access Analyzer policy validation addresses the separate need to identify policy errors and security warnings before broad access is granted because policy validation analyzes IAM policy documents for issues and best-practice findings; it is not as direct as IAM Identity Center workforce access for the actual requirement to centralize human access to multiple AWS accounts and supported applications.

Customer data classification addresses the separate need to decide who labels business data by sensitivity before selecting controls because customers classify information and determine required access and protection levels; it is not as direct as AWS Lambda compute platform for the actual requirement to identify who operates the physical and service infrastructure for Lambda execution.

Customer S3 bucket policy addresses the separate need to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; it is not as direct as AWS Lambda compute platform for the actual requirement to identify who operates the physical and service infrastructure for Lambda execution.

AWS physical data-center security addresses the separate need to identify who protects buildings, hardware and physical facilities because AWS controls physical access, environmental safeguards and infrastructure facilities supporting its services; it is not as direct as AWS Lambda compute platform for the actual requirement to identify who operates the physical and service infrastructure for Lambda execution.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to detect suspicious account or workload behavior from security signals, which calls for Amazon GuardDuty threat detection rather than AWS Security Hub centralized findings or the earlier AWS Organizations SCP.

AWS Trusted Advisor security checks is intended to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost; in this design the new outcome is to detect suspicious account or workload behavior from security signals, which calls for Amazon GuardDuty threat detection rather than AWS Trusted Advisor security checks or the earlier AWS Organizations SCP.

AWS Organizations SCP primarily supports the earlier need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts, but the new task is to detect suspicious account or workload behavior from security signals; that is why Amazon GuardDuty threat detection is preferable here.

Amazon CloudWatch metrics is intended to observe resource utilization and service performance over time because cloudWatch gathers metrics, alarms and logs for operational monitoring; in this design the new outcome is to verify whether a required service and control are available in the chosen AWS Region, which calls for Regional service eligibility rather than Amazon CloudWatch metrics or the earlier AWS service compliance inheritance.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to verify whether a required service and control are available in the chosen AWS Region, which calls for Regional service eligibility rather than AWS KMS managed keys or the earlier AWS service compliance inheritance.

AWS service compliance inheritance primarily supports the earlier need to use AWS audited infrastructure controls as supporting evidence because customers may inherit relevant provider controls while remaining responsible for their own controls, but the new task is to verify whether a required service and control are available in the chosen AWS Region; that is why Regional service eligibility is preferable here.

AWS IAM Access Analyzer primarily supports the earlier need to detect external sharing and analyze access policies for supported resources because access Analyzer produces findings and policy analysis that aid least-privilege reviews, but the new task is to securely store supported credentials and coordinate secret rotation; that is why AWS Secrets Manager is preferable here.

AWS Shield Standard is intended to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources; in this design the new outcome is to securely store supported credentials and coordinate secret rotation, which calls for AWS Secrets Manager rather than AWS Shield Standard or the earlier AWS IAM Access Analyzer.

Amazon Inspector is intended to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources; in this design the new outcome is to securely store supported credentials and coordinate secret rotation, which calls for AWS Secrets Manager rather than Amazon Inspector or the earlier AWS IAM Access Analyzer.

Customer Lambda function code addresses the separate need to identify who writes and secures the application logic of a Lambda function because customers own the code, dependencies and identity permissions they provide to a Lambda function; it is not as direct as AWS hardware lifecycle for the actual requirement to identify who replaces failed drives and server components in AWS facilities.

Customer application patching on EC2 addresses the separate need to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; it is not as direct as AWS hardware lifecycle for the actual requirement to identify who replaces failed drives and server components in AWS facilities.

AWS managed RDS infrastructure addresses the separate need to identify who handles the underlying operating system for an Amazon RDS DB instance because AWS operates the managed database platform and underlying host maintenance for RDS; it is not as direct as AWS hardware lifecycle for the actual requirement to identify who replaces failed drives and server components in AWS facilities.

Customer EC2 guest OS patching addresses the separate need to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; it is not as direct as AWS hardware lifecycle for the actual requirement to identify who replaces failed drives and server components in AWS facilities.

That description belongs to Federated identity access because federation allows trusted identities to receive AWS access without separate IAM user passwords; it is used to let an existing external identity provider authenticate users for AWS access, not to explain how IAM Identity Center external directory provides the function to integrate existing workforce identities with AWS account access.

That description belongs to IAM role temporary credentials because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is used to provide temporary access to a trusted principal or AWS workload, not to explain how IAM Identity Center external directory provides the function to integrate existing workforce identities with AWS account access.

That description belongs to Amazon Cognito identity pools because cognito identity pools exchange supported authentication for temporary AWS credentials; it is used to provide AWS credentials to application users using supported identities, not to explain how IAM Identity Center external directory provides the function to integrate existing workforce identities with AWS account access.

Password policy addresses the separate need to set complexity and lifetime requirements for applicable IAM user passwords because account password policy governs certain IAM user console passwords; it is not as direct as IAM group for the actual requirement to manage similar IAM user permissions through group membership.

AWS managed IAM policies addresses the separate need to use a predefined AWS-maintained permissions policy when its scope is appropriate because AWS managed policies are maintained by AWS and may change as services evolve; it is not as direct as IAM group for the actual requirement to manage similar IAM user permissions through group membership.

IAM Identity Center external directory addresses the separate need to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; it is not as direct as IAM group for the actual requirement to manage similar IAM user permissions through group membership.

That description belongs to AWS Security Lake centralized security data because security Lake can centralize supported security event and log data for analysis; it is used to collect security logs in an analyzable data lake, not to explain how Data-residency region choice provides the function to select a deployment geography to meet an organization's data-location requirements.

That description belongs to Amazon Macie sensitive-data discovery because macie uses machine learning and pattern matching to discover sensitive data in S3; it is used to locate sensitive information such as personal data in Amazon S3, not to explain how Data-residency region choice provides the function to select a deployment geography to meet an organization's data-location requirements.

That description belongs to AWS Organizations SCP because service control policies limit the permissions available to principals in affected member accounts; it is used to establish maximum account permissions across an AWS organization, not to explain how Data-residency region choice provides the function to select a deployment geography to meet an organization's data-location requirements.