Security and Compliance · Topic 1 of 5
The Shared Responsibility Model
Learn who secures what in AWS: security of the cloud versus security in the cloud, how duties change by service, and shared and inherited controls.
- 4 min
- Includes a diagram
- AWS is responsible for security of the cloud: hardware, software, networking and facilities.
- The customer is responsible for security in the cloud: data, access, configuration and guest operating systems.
- Responsibility moves toward AWS as services become more managed.
What it is
The shared responsibility model divides security work between AWS and the customer. It is one of the most tested ideas on the exam.
AWS is responsible for security of the cloud. The customer is responsible for security in the cloud.
The split is not the same for every service. The more AWS manages for you, the less you have to secure yourself.
How it works
What AWS is responsible for
AWS protects the infrastructure that runs all its services. This includes the physical data centers, the hardware, the networking equipment and the software that provides compute, storage, database and network services.
AWS also runs the global infrastructure, which is made of Regions, Availability Zones and edge locations. If a disk or server in a data center fails, replacing it is AWS's job.
What the customer is responsible for
The customer decides how to use the services and must secure that use. Typical customer duties are:
- Protecting and classifying their data, including choosing whether to encrypt it.
- Managing access with AWS Identity and Access Management (IAM).
- Configuring firewalls such as security groups and network access control lists.
- Patching and securing the guest operating system and applications on virtual servers they run.
- Choosing a Region and keeping to the rules that apply to their data.
Responsibility changes by service type
The more managed the service, the more AWS takes on.
| Service example | AWS manages | Customer manages |
|---|---|---|
| Amazon Elastic Compute Cloud (EC2), virtual servers | Hardware, virtualisation layer, facilities | Guest operating system, patches, applications, security group rules, data |
| Amazon Relational Database Service (RDS), managed database | Hardware, operating system and database engine patching | Data, access control, network settings, who can connect |
| Amazon Simple Storage Service (S3), object storage | Infrastructure, platform and storage service | Data, bucket permissions, encryption choices |
| AWS Lambda (serverless code) | Servers, operating system, runtime patching | Function code, its permissions and the data it handles |
With EC2 you have the most control and therefore the most work. With S3 or Lambda, AWS handles almost everything below your data and code.
Shared controls
Some controls apply to both sides, each in its own scope.
| Control | AWS part | Customer part |
|---|---|---|
| Patch management | Patches the infrastructure and managed service software | Patches guest operating systems and applications |
| Configuration management | Configures its infrastructure devices | Configures their own guest systems, databases and applications |
| Awareness and training | Trains its own staff | Trains their own staff |
Inherited controls
A customer inherits some controls fully from AWS. Physical and environmental controls, such as security guards and data center cooling, are the usual example.
Because of this, a customer does not need to prove physical security of the data center in their own audit. They can use AWS compliance reports instead.
What to remember for the exam
- AWS is responsible for security of the cloud: hardware, software, networking and facilities.
- The customer is responsible for security in the cloud: data, access, configuration and guest operating systems.
- Responsibility moves toward AWS as services become more managed.
- On EC2, the customer patches the guest operating system and applications.
- On RDS, AWS patches the database software and operating system, and the customer controls data and access.
- Customer data is the customer's responsibility.
- Patch management, configuration management and training are shared controls.
- Physical and environmental controls are inherited from AWS.
Ask "can I see or touch this layer?" If the answer is yes, such as the guest operating system on EC2, it is probably yours. If it is hardware, a hypervisor or a data center, it belongs to AWS.
Common mistakes
Assuming AWS secures your data. AWS provides tools to protect it, but you decide who may access it and whether it is encrypted.
Forgetting patching on EC2. AWS does not patch the operating system inside your instances.
Thinking managed services remove all duties. Even with a fully managed service, you still manage permissions and data.
Mixing up shared and inherited. Shared controls apply to both sides in different ways, while inherited controls come entirely from AWS.
Do not answer "AWS" for a question about a misconfigured public S3 bucket. Bucket permissions are a customer setting.
Check yourself
Who patches the guest operating system on an Amazon EC2 instance?
The customer, because security in the cloud includes the guest operating system.
Which control is an example of an inherited control?
Physical and environmental security of the data centers.
Who is responsible for the hardware that runs Amazon S3?
AWS, as part of security of the cloud.
Topic 1 of 5 in Security and Compliance
Test yourself on Security and Compliance
The full AWS CLF-C02 question bank has 832 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.