City policy mandates a specific third-party WAF or IDS brand that is not a native AWS service. Where does the team procure that third-party security software for use with AWS?

If city policy mandates a specific third-party WAF or IDS brand that is not a native AWS service, the team procures that software through AWS Marketplace. Marketplace is the AWS digital catalog where customers find, buy, and deploy third-party software and services—including security appliances and SaaS—often with usage-based billing consolidated into the AWS bill. For a municipality required to run a named commercial WAF or IDS alongside or instead of native controls, Marketplace is the procurement and fulfillment path that integrates with AWS accounts.

AWS Artifact provides on-demand access to AWS compliance reports and agreements; it is not a storefront that installs commercial IDS appliances. Amazon Route 53 health checks monitor endpoint health for DNS failover and routing; they are not a WAF license marketplace. AWS IAM Access Analyzer helps identify external access to resources; it is an analysis capability, not the purchase channel for firewalls.

Exam caveat: Native AWS WAF/Shield versus third-party tools is a deliberate distinction. When the stem insists on a mandated third-party brand, answer Marketplace—not Artifact, not IAM tools, not Route 53. Artifact remains the place for SOC/ISO-style reports about AWS itself.

Operational check: search Marketplace for the mandated WAF/IDS product, review pricing and deployment model (AMI, container, SaaS), ensure procurement and legal approve the subscription terms for public-sector use, deploy into a secured VPC subnet with least-privilege IAM and tight security groups, and document how the third-party control complements native CloudTrail, GuardDuty, and Config monitoring already required by city policy.