A company is moving its reporting database from a self-managed server to Amazon RDS. After the migration, which security responsibility remains with the company?
Show answer and explanation
Answer: D
RDS is a managed database service. AWS operates the underlying hardware and host operating system, patches the database engine, and provides automated backups and storage durability. The customer still decides who can connect, which network paths are open, how database users and IAM authentication are configured, and which encryption options are enabled.
Why the other options are wrong
- A. The host operating system of an RDS instance is not exposed to customers, and AWS applies those patches as part of the managed service.
- B. Physical facilities and hardware belong to AWS, which operates them under the shared responsibility model. The customer has no role in them.
- C. AWS handles replacement of failed physical hardware beneath managed storage. The customer restores data from backups but does not replace devices.