AWS service compliance inheritance is intended to use AWS audited infrastructure controls as supporting evidence because customers may inherit relevant provider controls while remaining responsible for their own controls; in this design the new outcome is to establish governed multi-account environments with standardized controls, which calls for AWS Control Tower landing zone rather than AWS service compliance inheritance or the earlier AWS Organizations SCP.

AWS CloudTrail event history is intended to review who invoked AWS management API actions in an account because cloudTrail records AWS account API activity and supports investigation of management actions; in this design the new outcome is to establish governed multi-account environments with standardized controls, which calls for AWS Control Tower landing zone rather than AWS CloudTrail event history or the earlier AWS Organizations SCP.

AWS Organizations SCP primarily supports the earlier need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts, but the new task is to establish governed multi-account environments with standardized controls; that is why AWS Control Tower landing zone is preferable here.

IAM resource-based policy addresses a different objective, to grant access through a policy attached to a supported resource, because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; the checklist instead requires the distinct outcomes to limit the maximum permissions an identity policy can grant to a user or role; define what actions an IAM principal may perform on specified resources.

Implicit deny default addresses a different objective, to understand why a principal cannot act without an applicable permission, because AWS authorization defaults to denying requests unless a valid policy grants the needed action; the checklist instead requires the distinct outcomes to limit the maximum permissions an identity policy can grant to a user or role; define what actions an IAM principal may perform on specified resources.

IAM policy condition addresses a different objective, to limit authorized requests using context such as MFA, source or tags where supported, because IAM policy conditions refine when an allow or deny statement applies; the checklist instead requires the distinct outcomes to limit the maximum permissions an identity policy can grant to a user or role; define what actions an IAM principal may perform on specified resources.

Encryption at rest is intended to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure; in this design the new outcome is to record selected IP network-flow information for VPC resources, which calls for Amazon VPC Flow Logs traffic metadata rather than Encryption at rest or the earlier Access analysis.

Amazon Macie sensitive-data discovery is intended to locate sensitive information such as personal data in Amazon S3 because macie uses machine learning and pattern matching to discover sensitive data in S3; in this design the new outcome is to record selected IP network-flow information for VPC resources, which calls for Amazon VPC Flow Logs traffic metadata rather than Amazon Macie sensitive-data discovery or the earlier Access analysis.

Access analysis primarily supports the earlier need to find unintended external or broad permissions on AWS resources because IAM Access Analyzer can help identify supported resources shared with external principals and analyze access, but the new task is to record selected IP network-flow information for VPC resources; that is why Amazon VPC Flow Logs traffic metadata is preferable here.

Explicit deny precedence is intended to ensure a denied API action cannot be overridden by another allow statement because an applicable explicit deny in AWS authorization evaluation overrides applicable allows; in this design the new outcome is to allow a principal in one AWS account to gain defined temporary permissions in another, which calls for Cross-account role assumption rather than Explicit deny precedence or the earlier IAM group.

IAM group primarily supports the earlier need to manage similar IAM user permissions through group membership because an IAM group is a collection of IAM users that can share attached permissions policies, but the new task is to allow a principal in one AWS account to gain defined temporary permissions in another; that is why Cross-account role assumption is preferable here.

Inline IAM policy is intended to bind a permissions policy directly to one identity rather than sharing it because an inline policy maintains a one-to-one association with an IAM user, group or role; in this design the new outcome is to allow a principal in one AWS account to gain defined temporary permissions in another, which calls for Cross-account role assumption rather than Inline IAM policy or the earlier IAM group.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to reuse an organization-authored permissions policy across appropriate identities, which calls for Customer managed IAM policies rather than IAM Identity Center external directory or the earlier AWS managed IAM policies.

Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to reuse an organization-authored permissions policy across appropriate identities, which calls for Customer managed IAM policies rather than Amazon Cognito identity pools or the earlier AWS managed IAM policies.

AWS managed IAM policies primarily supports the earlier need to use a predefined AWS-maintained permissions policy when its scope is appropriate because AWS managed policies are maintained by AWS and may change as services evolve, but the new task is to reuse an organization-authored permissions policy across appropriate identities; that is why Customer managed IAM policies is preferable here.

It does not scan a customer's EC2 instances for vulnerabilities; that caveat is associated more closely with AWS Artifact compliance reports for the need to obtain AWS third-party compliance reports and contractual documents than with AWS Audit Manager evidence collection for the requirement to organize evidence of AWS usage for audit assessments.

Provider compliance reports do not automatically certify customer-created workloads; that caveat is associated more closely with AWS service compliance inheritance for the need to use AWS audited infrastructure controls as supporting evidence than with AWS Audit Manager evidence collection for the requirement to organize evidence of AWS usage for audit assessments.

Centralizing logs must still include correct permissions and retention policies; that caveat is associated more closely with Centralized security logging for the need to retain and correlate audit records from multiple accounts than with AWS Audit Manager evidence collection for the requirement to organize evidence of AWS usage for audit assessments.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to restrict maximum access by applying organizational policies, which calls for AWS Organizations member-account guardrails rather than IAM Identity Center external directory or the earlier IAM access keys.

IAM role temporary credentials is intended to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; in this design the new outcome is to restrict maximum access by applying organizational policies, which calls for AWS Organizations member-account guardrails rather than IAM role temporary credentials or the earlier IAM access keys.

IAM access keys primarily supports the earlier need to authorize programmatic AWS API access for a permitted IAM principal because an access key ID and secret key can sign API requests but require careful protection and rotation, but the new task is to restrict maximum access by applying organizational policies; that is why AWS Organizations member-account guardrails is preferable here.

AWS Trusted Advisor security checks is intended to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost; in this design the new outcome is to use customer-controlled single-tenant hardware security modules for key workloads, which calls for AWS CloudHSM dedicated HSMs rather than AWS Trusted Advisor security checks or the earlier AWS Security Lake centralized security data.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to use customer-controlled single-tenant hardware security modules for key workloads, which calls for AWS CloudHSM dedicated HSMs rather than AWS Security Hub centralized findings or the earlier AWS Security Lake centralized security data.

AWS Security Lake centralized security data primarily supports the earlier need to collect security logs in an analyzable data lake because security Lake can centralize supported security event and log data for analysis, but the new task is to use customer-controlled single-tenant hardware security modules for key workloads; that is why AWS CloudHSM dedicated HSMs is preferable here.

That description belongs to AWS Certificate Manager TLS certificates because aCM manages public or imported certificates for use with integrated services; it is used to provision and manage certificates for supported TLS endpoints, not to explain how AWS WAF web request filtering provides the function to filter HTTP and HTTPS requests reaching supported applications.

That description belongs to AWS Shield DDoS protection because shield provides DDoS protection for supported AWS resources, with additional capabilities in advanced offerings; it is used to reduce the effect of distributed denial-of-service attacks on supported applications, not to explain how AWS WAF web request filtering provides the function to filter HTTP and HTTPS requests reaching supported applications.

That description belongs to AWS KMS managed keys because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; it is used to control encryption keys for supported AWS integrated services, not to explain how AWS WAF web request filtering provides the function to filter HTTP and HTTPS requests reaching supported applications.

Inline IAM policy primarily supports the earlier need to bind a permissions policy directly to one identity rather than sharing it because an inline policy maintains a one-to-one association with an IAM user, group or role, but the new task is to use a predefined AWS-maintained permissions policy when its scope is appropriate; that is why AWS managed IAM policies is preferable here.

IAM resource-based policy is intended to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; in this design the new outcome is to use a predefined AWS-maintained permissions policy when its scope is appropriate, which calls for AWS managed IAM policies rather than IAM resource-based policy or the earlier Inline IAM policy.

IAM user is intended to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions; in this design the new outcome is to use a predefined AWS-maintained permissions policy when its scope is appropriate, which calls for AWS managed IAM policies rather than IAM user or the earlier Inline IAM policy.

KMS key policies do not decide which data is personally identifiable; that caveat is associated more closely with AWS KMS managed keys for the need to control encryption keys for supported AWS integrated services than with AWS Certificate Manager TLS certificates for the requirement to provision and manage certificates for supported TLS endpoints.

Sharing infrastructure resources is distinct from sharing long-term access keys; that caveat is associated more closely with AWS Resource Access Manager sharing for the need to share supported AWS resources across accounts in a controlled way than with AWS Certificate Manager TLS certificates for the requirement to provision and manage certificates for supported TLS endpoints.

A web firewall is not a replacement for subnet routing or IAM policy management; that caveat is associated more closely with AWS WAF web request filtering for the need to filter HTTP and HTTPS requests reaching supported applications than with AWS Certificate Manager TLS certificates for the requirement to provision and manage certificates for supported TLS endpoints.