A city HR portal runs on AWS. Leadership asks who decides how employee records are classified and who may access them. Which statement is accurate?
Select an answer to reveal the explanation.
Short Explanation
Moving filing cabinets to a rented building does not mean the landlord decides who opens personnel folders. On AWS, the city still owns classification and access choices for its HR data. AWS provides the platform; identity and data decisions stay with the customer.
Full Explanation
Data classification and access decisions remain customer responsibilities even when a city HR portal runs on AWS. Shared responsibility does not transfer ownership of how employee records are labeled, who may open them, or which IAM policies and application roles enforce those decisions. AWS provides the infrastructure and many managed services, but it does not automatically classify municipal HR data or assign city staff access by default simply because objects reside in an AWS Region. AWS Support likewise does not become the approver for who reads personnel files. Conceptually, relocating filing cabinets into a rented facility does not make the landlord the records manager. Why distractors fail: treating AWS as the default classifier conflates hosting location with data governance; assuming Region residency alone moves classification duty to AWS ignores the customer side of the model; elevating Support as the access authority invents a workflow that is not how identity and authorization work. Exam caveat: managed storage or databases can reduce undifferentiated operational toil without removing customer accountability for sensitive data handling. Operational check: document classification labels, map them to IAM policies and application entitlements, review access periodically, and ensure CloudTrail or equivalent logging can show who accessed HR datasets.