Exercise 2: Whose Fault Is an Unpatched EC2 Instance? — Possible Solution
====================================================================

Under the shared responsibility model, AWS is responsible for security
OF the cloud -- the physical data centers, the underlying hardware,
the hypervisor/virtualization layer, and the global network. The
customer is responsible for security IN the cloud -- and for an
unmanaged EC2 instance specifically, that includes the ENTIRE guest
operating system running on top of that virtualization layer:
choosing the OS, configuring it, and applying its own security
patches over time.

An EC2 instance is deliberately one of the LEAST-managed AWS services
in this respect -- AWS gives you a raw virtual machine and stops
there. It never patches your operating system for you, never scans it
for known vulnerabilities on your behalf, and has no visibility into
what software you've installed on top of it.

ANSWER: This failure is squarely the company's own responsibility, not
AWS's. AWS fulfilled its own real half of the model (the underlying
infrastructure was available and uncompromised); the company failed
to fulfill its own half (patching the guest operating system it fully
owns), and a known, publicly documented vulnerability being left
unpatched for a year is exactly the kind of real, common, and
entirely preventable failure the shared responsibility model exists
to make unambiguous.

WHY THIS WORKS AS AN ANSWER
------------------------------
This correctly applies the specific "of the cloud" vs. "in the cloud"
line from the chapter to a real EC2 scenario, rather than treating the
shared responsibility model as a vague disclaimer -- and explicitly
identifies EC2's own OS-patching as customer-side responsibility,
which is precisely the aspect that shifts (as Exercise 3 explores)
once a more managed service is used instead.