Question

A company runs multiple Amazon EC2 instances hosting web applications. During a security audit, the auditor identifies that several instances are running outdated operating system versions with known vulnerabilities. Who is responsible for patching the guest operating systems on these EC2 instances according to the AWS shared responsibility model?

Accepted Answer

The customer is responsible for patching the guest operating systems on EC2 instances

Answer

AWS is responsible for patching the guest operating systems as part of the managed service

Answer

Both AWS and the customer share equal responsibility for guest OS patching through AWS Systems Manager

Answer

AWS is responsible for patching if the instances use AWS-provided AMIs, otherwise the customer is responsible