The city adopts a managed AWS database service and a manager asks whether IAM policies for that service can be ignored. Which statement is correct?
Select an answer to reveal the explanation.
Short Explanation
Managed database still needs who-gets-a-key rules. AWS may run more of the engine, but you still decide who can connect and what they can do. Don't skip IAM because service is 'managed'; that leaves doors unlocked.
Full Explanation
The correct statement is that access control remains a customer responsibility even when using managed AWS services. Managed means AWS takes on more undifferentiated database host and engine operations; it does not mean IAM policies can be ignored or that doors may be left unlocked. The claim that managed services remove all need for customer access control and IAM policies is the opposite of shared responsibility guidance. The claim that IAM is required only for Amazon EC2 and never for managed databases is wrong because managed databases still require careful identity and authorization design. The suggestion that only AWS root credentials should be used for day-to-day managed-service access is a dangerous antipattern; root should be reserved for rare account-level tasks. Why the teaching point holds: managed kitchen still needs who-gets-a-key rules. Distractors that confine IAM to EC2, that prescribe root for routine access, or that treat managed as 'no IAM' all fail conceptually. Exam caveat: watch for wording that equates managed operations with deleted customer security duties — CLF items frequently test that misconception. Operational check: attach least-privilege IAM policies (or database authentication patterns approved for the service), disable overly broad access, enable logging, and periodically review who can connect to production municipal databases and their snapshots.