IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to authorize programmatic AWS API access for a permitted IAM principal, which calls for IAM access keys rather than IAM Identity Center external directory or the earlier Password policy.

AWS Organizations member-account guardrails is intended to restrict maximum access by applying organizational policies because organization-level policies can constrain member accounts regardless of broader IAM allows; in this design the new outcome is to authorize programmatic AWS API access for a permitted IAM principal, which calls for IAM access keys rather than AWS Organizations member-account guardrails or the earlier Password policy.

Password policy primarily supports the earlier need to set complexity and lifetime requirements for applicable IAM user passwords because account password policy governs certain IAM user console passwords, but the new task is to authorize programmatic AWS API access for a permitted IAM principal; that is why IAM access keys is preferable here.

AWS hypervisor maintenance is intended to identify who maintains the virtualization host beneath an EC2 instance because AWS manages the host operating environment and virtualization components for EC2; in this design the new outcome is to identify who sets database credentials and network exposure for an RDS workload, which calls for Customer RDS access controls rather than AWS hypervisor maintenance or the earlier Customer VPC network design.

AWS Lambda compute platform is intended to identify who operates the physical and service infrastructure for Lambda execution because AWS runs and scales the underlying Lambda compute service and manages its infrastructure; in this design the new outcome is to identify who sets database credentials and network exposure for an RDS workload, which calls for Customer RDS access controls rather than AWS Lambda compute platform or the earlier Customer VPC network design.

Customer VPC network design primarily supports the earlier need to determine who selects subnets, routes and exposure within a VPC because customers design and configure their isolated network environment on AWS, but the new task is to identify who sets database credentials and network exposure for an RDS workload; that is why Customer RDS access controls is preferable here.

Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to reuse an organization-authored permissions policy across appropriate identities, which calls for Customer managed IAM policies rather than Amazon Cognito identity pools or the earlier IAM policy condition.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to reuse an organization-authored permissions policy across appropriate identities, which calls for Customer managed IAM policies rather than IAM Identity Center external directory or the earlier IAM policy condition.

IAM policy condition primarily supports the earlier need to limit authorized requests using context such as MFA, source or tags where supported because IAM policy conditions refine when an allow or deny statement applies, but the new task is to reuse an organization-authored permissions policy across appropriate identities; that is why Customer managed IAM policies is preferable here.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to aggregate and prioritize security findings from AWS and partner services, which calls for AWS Security Hub centralized findings rather than AWS KMS managed keys or the earlier AWS Security Lake centralized security data.

Encryption at rest is intended to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure; in this design the new outcome is to aggregate and prioritize security findings from AWS and partner services, which calls for AWS Security Hub centralized findings rather than Encryption at rest or the earlier AWS Security Lake centralized security data.

AWS Security Lake centralized security data primarily supports the earlier need to collect security logs in an analyzable data lake because security Lake can centralize supported security event and log data for analysis, but the new task is to aggregate and prioritize security findings from AWS and partner services; that is why AWS Security Hub centralized findings is preferable here.

AWS WAF managed rule groups addresses a different objective, to apply common web-request protection patterns using maintained rules, because managed rule groups provide ready-to-use WAF rules for supported web endpoints; the checklist instead requires the distinct outcomes to find answers to common AWS technical and security questions; manage TLS certificates for integrated AWS applications.

AWS CloudTrail addresses a different objective, to investigate account actions and API activity relevant to a security event, because cloudTrail supplies audit records of supported management events; the checklist instead requires the distinct outcomes to find answers to common AWS technical and security questions; manage TLS certificates for integrated AWS applications.

AWS Well-Architected Tool addresses a different objective, to review a workload against architectural best practices including security, because the Well-Architected Tool provides structured questions and improvement recommendations; the checklist instead requires the distinct outcomes to find answers to common AWS technical and security questions; manage TLS certificates for integrated AWS applications.

Security posture evaluation is intended to identify departures from approved secure configuration baselines because posture tools and configuration checks compare resource settings against security standards; in this design the new outcome is to evaluate a configuration against a defined compliance requirement, which calls for AWS Config rules rather than Security posture evaluation or the earlier AWS Config configuration history.

AWS Config configuration history primarily supports the earlier need to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules, but the new task is to evaluate a configuration against a defined compliance requirement; that is why AWS Config rules is preferable here.

AWS Trusted Advisor security checks is intended to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost; in this design the new outcome is to evaluate a configuration against a defined compliance requirement, which calls for AWS Config rules rather than AWS Trusted Advisor security checks or the earlier AWS Config configuration history.

AWS Knowledge Center primarily supports the earlier need to find answers to common AWS technical and security questions because the Knowledge Center provides support-style articles about known issues and features, but the new task is to obtain eligible third-party security software through AWS Marketplace; that is why AWS Marketplace security solutions is preferable here.

Amazon Inspector is intended to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources; in this design the new outcome is to obtain eligible third-party security software through AWS Marketplace, which calls for AWS Marketplace security solutions rather than Amazon Inspector or the earlier AWS Knowledge Center.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to obtain eligible third-party security software through AWS Marketplace, which calls for AWS Marketplace security solutions rather than AWS Security Center or the earlier AWS Knowledge Center.

Customer EC2 guest OS patching primarily supports the earlier need to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening, but the new task is to determine who ensures application use and data handling meet the customer's regulations; that is why Customer compliance obligations is preferable here.

Customer data classification is intended to decide who labels business data by sensitivity before selecting controls because customers classify information and determine required access and protection levels; in this design the new outcome is to determine who ensures application use and data handling meet the customer's regulations, which calls for Customer compliance obligations rather than Customer data classification or the earlier Customer EC2 guest OS patching.

Customer encryption configuration is intended to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection; in this design the new outcome is to determine who ensures application use and data handling meet the customer's regulations, which calls for Customer compliance obligations rather than Customer encryption configuration or the earlier Customer EC2 guest OS patching.

Cross-account role assumption addresses the separate need to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration; it is not as direct as Inline IAM policy for the actual requirement to bind a permissions policy directly to one identity rather than sharing it.

Customer managed IAM policies addresses the separate need to reuse an organization-authored permissions policy across appropriate identities because customer managed policies allow centralized versioning and reuse of customized permissions; it is not as direct as Inline IAM policy for the actual requirement to bind a permissions policy directly to one identity rather than sharing it.

IAM permissions boundary addresses the separate need to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions; it is not as direct as Inline IAM policy for the actual requirement to bind a permissions policy directly to one identity rather than sharing it.

WAF filtering cannot correct a compromised IAM administrator account; that caveat is associated more closely with AWS WAF managed rule groups for the need to apply common web-request protection patterns using maintained rules than with AWS KMS for the requirement to manage cryptographic keys and their authorized use in AWS services.

It entails more specialized administration than standard KMS integrations; that caveat is associated more closely with AWS CloudHSM for the need to use dedicated hardware modules with direct cryptographic control than with AWS KMS for the requirement to manage cryptographic keys and their authorized use in AWS services.

It does not replace user authorization to application data; that caveat is associated more closely with AWS Certificate Manager for the need to manage TLS certificates for integrated AWS applications than with AWS KMS for the requirement to manage cryptographic keys and their authorized use in AWS services.

AWS Firewall Manager centralized policies primarily supports the earlier need to apply supported firewall protections consistently across multiple AWS accounts because firewall Manager provides central policy management for protections such as WAF and Shield-related configurations, but the new task is to identify departures from approved secure configuration baselines; that is why Security posture evaluation is preferable here.

AWS Config rules is intended to evaluate a configuration against a defined compliance requirement because config rules assess resource settings such as encryption or approved configuration states; in this design the new outcome is to identify departures from approved secure configuration baselines, which calls for Security posture evaluation rather than AWS Config rules or the earlier AWS Firewall Manager centralized policies.

AWS Config configuration history is intended to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules; in this design the new outcome is to identify departures from approved secure configuration baselines, which calls for Security posture evaluation rather than AWS Config configuration history or the earlier AWS Firewall Manager centralized policies.