Many are not zone or region specific - things like IAM policies. The primary way you constrain things to individual AZs is via placement into subnets which are in those AZs