IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to standardize workforce role assignments across multiple AWS accounts, which calls for Permission sets for account assignments rather than IAM Identity Center external directory or the earlier IAM Identity Center workforce access.

IAM Identity Center workforce access primarily supports the earlier need to centralize human access to multiple AWS accounts and supported applications because IAM Identity Center supports workforce federation and permission-set based access, but the new task is to standardize workforce role assignments across multiple AWS accounts; that is why Permission sets for account assignments is preferable here.

Service-linked IAM role is intended to delegate service-specific operations to an AWS service under a defined role because service-linked roles are tied to AWS services and have constrained predefined service purposes; in this design the new outcome is to standardize workforce role assignments across multiple AWS accounts, which calls for Permission sets for account assignments rather than Service-linked IAM role or the earlier IAM Identity Center workforce access.

IAM resource-based policy primarily supports the earlier need to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource, but the new task is to centralize human access to multiple AWS accounts and supported applications; that is why IAM Identity Center workforce access is preferable here.

AWS Systems Manager Parameter Store is intended to store configuration parameters and selected secrets for applications because parameter Store provides hierarchical parameter values with access controlled through IAM; in this design the new outcome is to centralize human access to multiple AWS accounts and supported applications, which calls for IAM Identity Center workforce access rather than AWS Systems Manager Parameter Store or the earlier IAM resource-based policy.

IAM role temporary credentials is intended to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; in this design the new outcome is to centralize human access to multiple AWS accounts and supported applications, which calls for IAM Identity Center workforce access rather than IAM role temporary credentials or the earlier IAM resource-based policy.

Amazon Cognito identity pools primarily supports the earlier need to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials, but the new task is to support sign-up and authentication of application end users; that is why Amazon Cognito user pools is preferable here.

Temporary session credentials is intended to avoid long-lived application secrets when making authorized AWS requests because temporary credentials expire and can be issued through IAM roles and federation; in this design the new outcome is to support sign-up and authentication of application end users, which calls for Amazon Cognito user pools rather than Temporary session credentials or the earlier Amazon Cognito identity pools.

Federated identity access is intended to let an existing external identity provider authenticate users for AWS access because federation allows trusted identities to receive AWS access without separate IAM user passwords; in this design the new outcome is to support sign-up and authentication of application end users, which calls for Amazon Cognito user pools rather than Federated identity access or the earlier Amazon Cognito identity pools.

IAM role trust policy primarily supports the earlier need to define which principals are allowed to assume a specific role because a role trust policy controls the trusted entities for role assumption, but the new task is to delegate service-specific operations to an AWS service under a defined role; that is why Service-linked IAM role is preferable here.

Cross-account role assumption is intended to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration; in this design the new outcome is to delegate service-specific operations to an AWS service under a defined role, which calls for Service-linked IAM role rather than Cross-account role assumption or the earlier IAM role trust policy.

Permission sets for account assignments is intended to standardize workforce role assignments across multiple AWS accounts because IAM Identity Center permission sets help define permissions provisioned for assigned users or groups; in this design the new outcome is to delegate service-specific operations to an AWS service under a defined role, which calls for Service-linked IAM role rather than Permission sets for account assignments or the earlier IAM role trust policy.

AWS managed IAM policies addresses the separate need to use a predefined AWS-maintained permissions policy when its scope is appropriate because AWS managed policies are maintained by AWS and may change as services evolve; it is not as direct as Customer managed IAM policies for the actual requirement to reuse an organization-authored permissions policy across appropriate identities.

IAM resource-based policy addresses the separate need to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; it is not as direct as Customer managed IAM policies for the actual requirement to reuse an organization-authored permissions policy across appropriate identities.

AWS Organizations member-account guardrails addresses the separate need to restrict maximum access by applying organizational policies because organization-level policies can constrain member accounts regardless of broader IAM allows; it is not as direct as Customer managed IAM policies for the actual requirement to reuse an organization-authored permissions policy across appropriate identities.

Permission sets for account assignments addresses the separate need to standardize workforce role assignments across multiple AWS accounts because IAM Identity Center permission sets help define permissions provisioned for assigned users or groups; it is not as direct as Customer managed IAM policies for the actual requirement to reuse an organization-authored permissions policy across appropriate identities.

They are not the central service for permission sets across employee AWS accounts; that caveat is associated more closely with Amazon Cognito user pools for the need to support sign-up and authentication of application end users than with Federated identity access for the requirement to let an existing external identity provider authenticate users for AWS access.

A user pool alone does not automatically authorize access to every S3 bucket; that caveat is associated more closely with Amazon Cognito identity pools for the need to provide AWS credentials to application users using supported identities than with Federated identity access for the requirement to let an existing external identity provider authenticate users for AWS access.

Roles avoid embedding a person's permanent access key in application code; that caveat is associated more closely with IAM role temporary credentials for the need to provide temporary access to a trusted principal or AWS workload than with Federated identity access for the requirement to let an existing external identity provider authenticate users for AWS access.

That description belongs to AWS Secrets Manager because secrets Manager stores protected secrets and supports rotation workflows; it is used to store and rotate supported application secrets without hard-coding them, not to explain how Amazon Cognito identity pools provides the function to provide AWS credentials to application users using supported identities.

That description belongs to IAM role temporary credentials because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is used to provide temporary access to a trusted principal or AWS workload, not to explain how Amazon Cognito identity pools provides the function to provide AWS credentials to application users using supported identities.

That description belongs to Amazon Cognito user pools because cognito user pools provide user directories and authentication features for apps; it is used to support sign-up and authentication of application end users, not to explain how Amazon Cognito identity pools provides the function to provide AWS credentials to application users using supported identities.

IAM role temporary credentials is intended to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; in this design the new outcome is to provide AWS credentials to application users using supported identities, which calls for Amazon Cognito identity pools rather than IAM role temporary credentials or the earlier AWS Secrets Manager.

AWS Secrets Manager primarily supports the earlier need to store and rotate supported application secrets without hard-coding them because secrets Manager stores protected secrets and supports rotation workflows, but the new task is to provide AWS credentials to application users using supported identities; that is why Amazon Cognito identity pools is preferable here.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to provide AWS credentials to application users using supported identities, which calls for Amazon Cognito identity pools rather than IAM Identity Center external directory or the earlier AWS Secrets Manager.

That description belongs to IAM role temporary credentials because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is used to provide temporary access to a trusted principal or AWS workload, not to explain how IAM access keys provides the function to authorize programmatic AWS API access for a permitted IAM principal.

That description belongs to IAM identity-based policy because identity-based policies attach to users, groups or roles and express allowed or denied actions; it is used to define what actions an IAM principal may perform on specified resources, not to explain how IAM access keys provides the function to authorize programmatic AWS API access for a permitted IAM principal.

That description belongs to AWS Organizations member-account guardrails because organization-level policies can constrain member accounts regardless of broader IAM allows; it is used to restrict maximum access by applying organizational policies, not to explain how IAM access keys provides the function to authorize programmatic AWS API access for a permitted IAM principal.

Amazon S3 One Zone-IA addresses the separate need to store recreatable infrequently accessed objects within one Availability Zone because one Zone-IA has a single-AZ resilience profile and lower storage cost; it is not as direct as EBS volume encryption for the actual requirement to protect block storage with supported at-rest encryption.

S3 Cross-Region Replication addresses the separate need to copy eligible objects asynchronously to a bucket in a different AWS Region because cross-Region Replication provides configured cross-Region object replication for supported cases; it is not as direct as EBS volume encryption for the actual requirement to protect block storage with supported at-rest encryption.

S3 Glacier Deep Archive addresses the separate need to retain long-lived archives at very low storage cost when restoration can be slow because deep Archive is designed for extremely infrequent access and long retention; it is not as direct as EBS volume encryption for the actual requirement to protect block storage with supported at-rest encryption.

AWS Developer Tools addresses the separate need to recognize the separation of build release deploy and tracing functions because AWS developer services specialize in different steps of software delivery; it is not as direct as AWS Step Functions for the actual requirement to coordinate multi-step application workflows with managed state.

AWS CodePipeline addresses the separate need to coordinate continuous delivery stages between tools because codePipeline orchestrates source build test and deployment actions; it is not as direct as AWS Step Functions for the actual requirement to coordinate multi-step application workflows with managed state.

Amazon SQS addresses the separate need to decouple systems with durable asynchronous message queues because sQS holds messages for consumers to process independently; it is not as direct as AWS Step Functions for the actual requirement to coordinate multi-step application workflows with managed state.