Objective and starting point
By the end of this lesson, assign an obligation only after naming the service and the affected layer. Lesson 01 introduced on-demand infrastructure; here the important question is who operates a particular part of it. Separate physical facilities, host infrastructure, a customer-managed guest operating system, application logic, and data-access decisions. These are different obligations even when one workload uses them together. “Shared” does not mean the two parties alternate randomly, and “managed” does not mean the customer has no decisions left.
A conditional responsibility ledger
AWS operates the physical and underlying infrastructure. In a customer-managed EC2 instance, the customer manages the guest operating system, including security updates, and its installed application software. RDS manages common database operations such as backups and software patching; query tuning still belongs to the customer. Customer controls must also reflect data sensitivity and organizational requirements. For Lambda Event Functions, underlying execution infrastructure is managed, while the customer retains workload data, access, and security configuration. Runtime updates require one more detail: AWS publishes managed-runtime updates, but their application depends on update mode. A container function requires customer image rebuild and redeployment. Do not use a managed-runtime rule as a universal container rule.
Worked example: the research collection
Fictional teaching case: a research group runs a collection-search application and a self-managed relational database on EC2. It considers moving only the database to RDS. Its checklist contains database-host maintenance, SQL query tuning, permissions for research assistants, and patching the application server guest OS. First separate the two components: the proposed move changes the database service, not the application server. Next reassign common database operations to the RDS boundary. Keep query tuning and the choice of permitted readers with the group. Finally keep the EC2 application server guest-OS updates with the group, since that component has not moved. The conclusion is a changed checklist for one component, not a transfer of every task in the project. Check it by tracing each task to the component actually changed.
Contrast and misconception
Now suppose the group instead leaves the database on EC2 and only redraws its project diagram with the label “cloud managed.” No service boundary changed, so the guest-OS duty did not move. Conversely, using RDS does not require researchers to replace physical servers. A useful test is to ask whether the obligation concerns operating infrastructure or deciding what the organization allows. Infrastructure abstraction can reduce operating work without determining the legitimate use of research data. This distinction prevents both over-assignment of AWS infrastructure work and under-assignment of customer access work.
Transfer check and check basis
Try before reading on: a separate laboratory deploys an Event Function as a container image and says AWS runtime updates make image maintenance unnecessary. Which missing distinction invalidates that conclusion? Check basis: container deployment differs from a managed runtime with Auto updates. The laboratory needs to rebuild and redeploy its container image for updates; it also retains workload permissions and code-security responsibilities. A complete explanation names the deployment assumption and the retained duty. Next attempt formal questions aws-clf-q-009 through aws-clf-q-012, then retrieve cards aws-clf-card-07 through aws-clf-card-09. Those are new scenarios; explain the layer before selecting an answer.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
What is AWS Lambda? - AWS LambdaSecurity in AWS Lambda - AWS LambdaUnderstanding the shared responsibility model for Lambda runtime management - AWS LambdaWhat is Amazon Relational Database Service (Amazon RDS)? - Amazon Relational Database ServiceSecurity in Amazon RDS - Amazon Relational Database ServiceShared Responsibility Model - Amazon Web Services (AWS)