Developers find a vulnerability in city-written API code running on Amazon EC2. Who is responsible for fixing that application security issue?
Select an answer to reveal the explanation.
Short Explanation
If the city wrote the API, the city owns the bug fix — cloud hosting does not rewrite your code for you. AWS secures the infrastructure underneath EC2; application vulnerabilities in customer software stay on the customer side. Downloadable compliance PDFs do not patch app flaws.
Full Explanation
When developers find a vulnerability in city-written API code running on Amazon EC2, the city is responsible for securing and fixing that application. Shared responsibility places application code, configuration, and patching of customer software on the customer side, while AWS secures the underlying EC2 infrastructure such as facilities, hardware, and the hypervisor. AWS Support does not rewrite municipal application code as a default shared-responsibility obligation. AWS does not automatically patch all customer application code on EC2. Amazon Artifact delivers compliance reports and agreements; downloading those PDFs does not remediate application bugs. Conceptually, if the city wrote the API, the city owns the fix — cloud hosting does not rewrite your code. Distractors fail by outsourcing app remediation to Support by default, by assuming automatic AWS patching of customer apps, or by treating Artifact as a bug-fix mechanism. Exam caveat: distinguish infrastructure CVE handling on AWS-managed layers from vulnerabilities in the city's own software packages and frameworks. Operational check: track application CVEs in the municipal backlog, patch or mitigate promptly, validate with testing, and ensure deployment pipelines can ship fixes to the EC2-hosted API without waiting on unrelated compliance downloads.