Staff running AWS Lambda notification functions believe they own no security duties because the service is serverless. What should the Cloud Practitioner clarify?
Select an answer to reveal the explanation.
Short Explanation
Serverless is like a managed kitchen where AWS runs the building systems — you still bring the recipe, the keys, and the secret sauce. Lambda code, IAM, and sensitive data handling stay on the customer side. “No duties” is the myth to retire.
Full Explanation
AWS manages the runtime infrastructure for Lambda, but customers still own their function code, identity and access settings, and sensitive data handling. Staff who believe serverless means zero security duties are incorrect under the shared responsibility model—notification functions still need careful IAM, secrets handling, and data protection.
Lambda customers do not have zero security responsibilities once deployed. AWS does not write customer function code and configure all IAM without review. Serverless does not put encryption, identity, and data handling forever out of scope for the city.
Exam caveat: Serverless reduces infrastructure duties; it does not delete customer security ownership of code and access. Operational check: review each notification function’s IAM role for least privilege, ensure secrets are not hardcoded, encrypt sensitive payloads as required, and include Lambda in the city’s secure-SDLC checklist.
Municipal teams should keep a one-page decision record linking this Cloud Practitioner concept to resident outcomes, revisit it after major traffic or compliance changes, and ensure runbooks still match the chosen design.
Municipal teams should keep a one-page decision record linking this Cloud Practitioner concept to resident outcomes, revisit it after major traffic or compliance changes, and ensure runbooks still match the chosen design.