AWS Trusted Advisor security checks primarily supports the earlier need to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost, but the new task is to collect security logs in an analyzable data lake; that is why AWS Security Lake centralized security data is preferable here.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to collect security logs in an analyzable data lake, which calls for AWS Security Lake centralized security data rather than AWS Security Hub centralized findings or the earlier AWS Trusted Advisor security checks.

Amazon Macie sensitive-data discovery is intended to locate sensitive information such as personal data in Amazon S3 because macie uses machine learning and pattern matching to discover sensitive data in S3; in this design the new outcome is to collect security logs in an analyzable data lake, which calls for AWS Security Lake centralized security data rather than Amazon Macie sensitive-data discovery or the earlier AWS Trusted Advisor security checks.

IAM identity-based policy primarily supports the earlier need to define what actions an IAM principal may perform on specified resources because identity-based policies attach to users, groups or roles and express allowed or denied actions, but the new task is to understand why a principal cannot act without an applicable permission; that is why Implicit deny default is preferable here.

IAM access keys is intended to authorize programmatic AWS API access for a permitted IAM principal because an access key ID and secret key can sign API requests but require careful protection and rotation; in this design the new outcome is to understand why a principal cannot act without an applicable permission, which calls for Implicit deny default rather than IAM access keys or the earlier IAM identity-based policy.

IAM role temporary credentials is intended to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; in this design the new outcome is to understand why a principal cannot act without an applicable permission, which calls for Implicit deny default rather than IAM role temporary credentials or the earlier IAM identity-based policy.

Regional service eligibility addresses a different objective, to verify whether a required service and control are available in the chosen AWS Region, because services, compliance capabilities and data-processing locations can differ by Region; the checklist instead requires the distinct outcomes to control encryption keys for supported AWS integrated services; use customer-controlled single-tenant hardware security modules for key workloads.

Security posture evaluation addresses a different objective, to identify departures from approved secure configuration baselines, because posture tools and configuration checks compare resource settings against security standards; the checklist instead requires the distinct outcomes to control encryption keys for supported AWS integrated services; use customer-controlled single-tenant hardware security modules for key workloads.

AWS CloudTrail event history addresses a different objective, to review who invoked AWS management API actions in an account, because cloudTrail records AWS account API activity and supports investigation of management actions; the checklist instead requires the distinct outcomes to control encryption keys for supported AWS integrated services; use customer-controlled single-tenant hardware security modules for key workloads.

That description belongs to Amazon Cognito identity pools because cognito identity pools exchange supported authentication for temporary AWS credentials; it is used to provide AWS credentials to application users using supported identities, not to explain how IAM role temporary credentials provides the function to provide temporary access to a trusted principal or AWS workload.

That description belongs to Cross-account role assumption because a cross-account role requires suitable trust and permission configuration; it is used to allow a principal in one AWS account to gain defined temporary permissions in another, not to explain how IAM role temporary credentials provides the function to provide temporary access to a trusted principal or AWS workload.

That description belongs to IAM access keys because an access key ID and secret key can sign API requests but require careful protection and rotation; it is used to authorize programmatic AWS API access for a permitted IAM principal, not to explain how IAM role temporary credentials provides the function to provide temporary access to a trusted principal or AWS workload.

Customer managed IAM policies addresses a different objective, to reuse an organization-authored permissions policy across appropriate identities, because customer managed policies allow centralized versioning and reuse of customized permissions; the checklist instead requires the distinct outcomes to store and rotate supported application secrets without hard-coding them; provide temporary access to a trusted principal or AWS workload.

IAM access keys addresses a different objective, to authorize programmatic AWS API access for a permitted IAM principal, because an access key ID and secret key can sign API requests but require careful protection and rotation; the checklist instead requires the distinct outcomes to store and rotate supported application secrets without hard-coding them; provide temporary access to a trusted principal or AWS workload.

IAM user addresses a different objective, to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate, because IAM users are identities defined within an AWS account with configurable permissions; the checklist instead requires the distinct outcomes to store and rotate supported application secrets without hard-coding them; provide temporary access to a trusted principal or AWS workload.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to share supported AWS resources across accounts in a controlled way, which calls for AWS Resource Access Manager sharing rather than AWS KMS managed keys or the earlier AWS Config configuration history.

AWS Config configuration history primarily supports the earlier need to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules, but the new task is to share supported AWS resources across accounts in a controlled way; that is why AWS Resource Access Manager sharing is preferable here.

AWS Certificate Manager TLS certificates is intended to provision and manage certificates for supported TLS endpoints because aCM manages public or imported certificates for use with integrated services; in this design the new outcome is to share supported AWS resources across accounts in a controlled way, which calls for AWS Resource Access Manager sharing rather than AWS Certificate Manager TLS certificates or the earlier AWS Config configuration history.

IAM Identity Center workforce access addresses the separate need to centralize human access to multiple AWS accounts and supported applications because IAM Identity Center supports workforce federation and permission-set based access; it is not as direct as IAM role trust policy for the actual requirement to define which principals are allowed to assume a specific role.

IAM Access Analyzer policy validation addresses the separate need to identify policy errors and security warnings before broad access is granted because policy validation analyzes IAM policy documents for issues and best-practice findings; it is not as direct as IAM role trust policy for the actual requirement to define which principals are allowed to assume a specific role.

IAM role permissions policy addresses the separate need to define which AWS operations a successfully assumed role can perform because permissions policies attached to a role determine allowed service actions within other policy limits; it is not as direct as IAM role trust policy for the actual requirement to define which principals are allowed to assume a specific role.

Explicit deny precedence addresses a different objective, to ensure a denied API action cannot be overridden by another allow statement, because an applicable explicit deny in AWS authorization evaluation overrides applicable allows; the checklist instead requires the distinct outcomes to reduce risk when long-lived programmatic secrets must be retained; retain individual accountability for actions taken in AWS.

Multi-factor authentication (MFA) addresses a different objective, to add a second authentication factor to protect interactive sign-in, because mFA requires an additional factor beyond a password or equivalent first credential; the checklist instead requires the distinct outcomes to reduce risk when long-lived programmatic secrets must be retained; retain individual accountability for actions taken in AWS.

IAM role permissions policy addresses a different objective, to define which AWS operations a successfully assumed role can perform, because permissions policies attached to a role determine allowed service actions within other policy limits; the checklist instead requires the distinct outcomes to reduce risk when long-lived programmatic secrets must be retained; retain individual accountability for actions taken in AWS.

Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to integrate existing workforce identities with AWS account access, which calls for IAM Identity Center external directory rather than Amazon Cognito identity pools or the earlier IAM Identity Center workforce access.

IAM Identity Center workforce access primarily supports the earlier need to centralize human access to multiple AWS accounts and supported applications because IAM Identity Center supports workforce federation and permission-set based access, but the new task is to integrate existing workforce identities with AWS account access; that is why IAM Identity Center external directory is preferable here.

IAM role temporary credentials is intended to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; in this design the new outcome is to integrate existing workforce identities with AWS account access, which calls for IAM Identity Center external directory rather than IAM role temporary credentials or the earlier IAM Identity Center workforce access.

Customer managed IAM policies is intended to reuse an organization-authored permissions policy across appropriate identities because customer managed policies allow centralized versioning and reuse of customized permissions; in this design the new outcome is to standardize workforce role assignments across multiple AWS accounts, which calls for Permission sets for account assignments rather than Customer managed IAM policies or the earlier IAM Identity Center external directory.

IAM Identity Center external directory primarily supports the earlier need to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access, but the new task is to standardize workforce role assignments across multiple AWS accounts; that is why Permission sets for account assignments is preferable here.

Service-linked IAM role is intended to delegate service-specific operations to an AWS service under a defined role because service-linked roles are tied to AWS services and have constrained predefined service purposes; in this design the new outcome is to standardize workforce role assignments across multiple AWS accounts, which calls for Permission sets for account assignments rather than Service-linked IAM role or the earlier IAM Identity Center external directory.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to standardize workforce role assignments across multiple AWS accounts, which calls for Permission sets for account assignments rather than IAM Identity Center external directory or the earlier IAM Identity Center workforce access.

IAM Identity Center workforce access primarily supports the earlier need to centralize human access to multiple AWS accounts and supported applications because IAM Identity Center supports workforce federation and permission-set based access, but the new task is to standardize workforce role assignments across multiple AWS accounts; that is why Permission sets for account assignments is preferable here.

Service-linked IAM role is intended to delegate service-specific operations to an AWS service under a defined role because service-linked roles are tied to AWS services and have constrained predefined service purposes; in this design the new outcome is to standardize workforce role assignments across multiple AWS accounts, which calls for Permission sets for account assignments rather than Service-linked IAM role or the earlier IAM Identity Center workforce access.