Who Is Responsible for WorkSpaces Infrastructure Security?
A company uses Amazon WorkSpaces. Which task is the responsibility of AWS, according to the AWS shared responsibility model?
Community Insight
The question tests where AWS's responsibility ends and the customer's begins for a managed desktop service; the trap is assuming anything touching user identity or logging is automatically an AWS duty.
Amazon WorkSpaces divides duties between AWS and the customer under the shared responsibility model. This page establishes that AWS owns the environmental safety and physical security of the infrastructure hosting WorkSpaces, while the customer manages user-level controls.
Learners often pick MFA or IAM because those feel like platform-level controls, but WorkSpaces user accounts and their authentication settings are customer-managed within the customer's directory.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Under the AWS shared responsibility model, AWS is responsible for security "of the cloud" — the facilities, hardware, networking, and environmental controls that underpin managed services such as Amazon WorkSpaces. AWS operates the data centers and host infrastructure, so ensuring environmental safety and physical security of the infrastructure that hosts WorkSpaces is squarely an AWS task. The customer never gets physical access to those facilities and cannot perform this duty, which is why option B is the only task listed that belongs to AWS.Why the Other Options Are Wrong
Option A is a customer task: enabling multi-factor authentication for each WorkSpaces user is configured through the customer's directory and WorkSpaces environment. Option C is also customer-owned because securing WorkSpaces user accounts with IAM policies, roles, and permissions is part of identity management in the customer's account. Option D is customer-controlled logging: the customer decides whether to create CloudTrail trails, which events to capture, and where to store the logs. None of these are physical or environmental infrastructure duties that AWS performs.Community Comment Notes
Both ShaiTay and Kaushal1987 selected option B, and ShaiTay quoted the exact task, "Ensure the environmental safety and security of the AWS infrastructure that hosts WorkSpaces." Their agreement reinforces the shared responsibility boundary: AWS handles the hosting environment, not the customer's user accounts, IAM policies, or CloudTrail configuration. The comments are brief but consistent with the exam's emphasis on separating "of the cloud" from "in the cloud" responsibilities.Official Reference
Exam Strategy
Ask whether the task is "of the cloud" or "in the cloud": physical, environmental, and hosting-layer controls belong to AWS, while identity, logging configuration, and user MFA belong to the customer. For WorkSpaces questions, map each option to either the managed infrastructure or the customer's directory and account settings.
Frequently Asked Questions
Why is configuring CloudTrail a customer responsibility for WorkSpaces?
CloudTrail is a customer-controlled logging service; the customer decides which trails to create, which events to capture, and where to store logs.
Does AWS manage MFA for WorkSpaces user accounts?
No. WorkSpaces authentication is tied to the customer's directory, so enabling and enforcing MFA for each user account is a customer task.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →