City counsel asks whether every AWS service automatically carries the exact same compliance certifications and scope for municipal workloads. Which statement reflects how AWS compliance applicability works at a foundational level?

Compliance certifications and scope can vary among AWS services; customers must verify coverage for the services they use. Think of AWS like a campus with many buildings — not every building carries the same safety plaque for every program, so city counsel still checks what applies to the tools the municipality actually adopted. It is incorrect that every AWS service always shares identical global certifications with no per-service review required. It is also incorrect that only Amazon EC2 is ever in scope while managed services never participate, or that compliance status becomes identical for every Region and service the moment an account is opened. Distractors fail by asserting universal identical coverage, by artificially limiting scope to EC2 alone, or by claiming instant blanket status at account creation. Exam caveat: even when a service appears in a certification's scope list, the customer's application architecture, data flows, and configuration choices still determine whether the overall civic solution meets regulatory obligations under shared responsibility. Operational check: for each major workload, list services and Regions in use, verify applicable AWS compliance documentation via Artifact or published service pages, note geographic and service scope boundaries in the risk register, and document residual city controls required to complete the regulatory narrative beyond AWS's attestations.