Find the customer's half of the shared responsibility model in a bucket and a function

Steps

1. Note which Region CloudShell is using, because that choice is yours, not AWS's: AWS keeps your content in the Region you pick.

echo $AWS_REGION

Then create a bucket in that Region:

aws s3 mb s3://clf-lab06-111122223333

2. Read the bucket's Block Public Access settings and its default encryption:

aws s3api get-public-access-block --bucket clf-lab06-111122223333
aws s3api get-bucket-encryption --bucket clf-lab06-111122223333 --query 'ServerSideEncryptionConfiguration.Rules[0].ApplyServerSideEncryptionByDefault.SSEAlgorithm'

All four public access settings read true, and the encryption reads "AES256". AWS supplies safe defaults and runs the storage, but these are your settings: you could change them, and a bucket opened to the public would be your exposure, not AWS's. Leave them exactly as they are. 3. Write the trust policy that lets the Lambda service use a role, and create the role with no permissions at all:

echo '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": {"Service": "lambda.amazonaws.com"}, "Action": "sts:AssumeRole"}]}' > trust.json
aws iam create-role --role-name clf-lab06-fn-role --assume-role-policy-document file://trust.json

What this role may do is entirely your decision. A function that needs nothing gets nothing, which is least privilege. 4. Write a function and package it:

cat > lambda_function.py <<'EOF'
def lambda_handler(event, context):
    return {"message": "hello from clf-lab06"}
EOF
zip fn.zip lambda_function.py

5. Create the function and run it once:

aws lambda create-function --function-name clf-lab06-hello --runtime python3.13 --handler lambda_function.lambda_handler --zip-file fileb://fn.zip --role arn:aws:iam::111122223333:role/clf-lab06-fn-role
aws lambda invoke --function-name clf-lab06-hello out.json
cat out.json

If create-function says the role cannot be assumed, wait ten seconds and run it again: a new role takes a few seconds to be usable. out.json holds {"message": "hello from clf-lab06"}. Because the role has no permissions, the function cannot even write logs, and that is fine for this lab. 6. Read back what Lambda manages for you and what you chose:

aws lambda get-function-configuration --function-name clf-lab06-hello --query '[Runtime,Handler,Role]' --output text

You chose the runtime, the code and the role. AWS runs the servers and their operating systems and keeps the managed python3.13 runtime patched. On EC2 the guest operating system and every package on it would be yours to patch; on Amazon RDS the database engine is patched by AWS, but database users and network access stay yours. 7. Sort these into AWS's half or yours, using the lesson's two questions (can I reach this layer, and is it my data, identity or setting?): the Lambda host's operating system; the code in lambda_function.py; the role's permissions; the S3 storage servers; the bucket's public access settings; the Region. The answers are in the Notes.