A logistics company uses AWS Elastic Beanstalk to deploy and scale a web application. The platform automatically provisions Amazon EC2 instances, an Application Load Balancer, and an Auto Scaling group to support the workload. The company's security team is defining the operational boundaries for securing this deployment.
Which of the following tasks remains the sole responsibility of the customer under the AWS Shared Responsibility Model?
- Configuring security group rules to restrict network access to the EC2 instances and applying updates to the application code.Answer
- BPatching the underlying virtualization hypervisors and physical network devices hosting the EC2 instances.
- CConfiguring stateless Network Access Control Lists (NACLs) inside the guest operating system of the EC2 instances to manage instance-level traffic.
- DConducting physical security audits of the AWS data centers and managing the compliance certifications of the host facilities.
Answer
Configuring security group rules to restrict network access to the EC2 instances and applying updates to the application code.
The correct option is correct because managing security groups and application code are customer responsibilities (security 'in' the cloud). Even though AWS Elastic Beanstalk automates deployment, the provisioned EC2 instances run in the customer's environment, leaving network access rules (security groups) and code security under the customer's control.
Step-by-Step Solution
Key Concept
Under the AWS Shared Responsibility Model, customers retain control and responsibility for configuration tasks (such as security groups and application updates) on resources provisioned in their accounts, even when deployed through managed or platform-level services.