AWS Shared Responsibility Model
The division of security duties between Amazon Web Services and the customer. The standard formulation: AWS is responsible for security of the cloud, and the customer is responsible for security in the cloud. Exam questions are almost always a sorting exercise — decide which side of that line a given task falls on.
Key points
- AWS is responsible for — the physical and environmental controls of the data centers, the hardware, the global infrastructure of Regions and Availability Zones, the virtualization layer, and the managed-service software itself. This includes patching the operating system underneath managed services such as Amazon RDS.
- The customer is responsible for — customer data first and foremost, plus:
- Classifying company assets in the cloud.
- Configuring the AWS-provided security group firewall, and network ACLs.
- Configuring AWS Identity and Access Management (IAM) users, groups, roles, policies and credentials.
- Application-level data security, and client-side and in-transit encryption of data.
- Management and patching of the guest operating system when the customer owns it, as on Amazon EC2.
- The line moves with the service model — on Amazon EC2 the customer patches the guest OS; on Amazon RDS or AWS Lambda AWS does. The more managed the service, the smaller the customer’s share. This is the same gradient described in Cloud Computing Concepts.
- Genuinely shared items — patch management, configuration management, and awareness and training are shared: AWS patches the infrastructure, the customer patches what it controls.
- AWS’s official control categories — AWS’s Shared Responsibility Model page further sorts controls into three buckets: inherited controls (fully inherited from AWS, such as physical and environmental controls), shared controls (apply to both AWS and the customer, but in separate contexts — this is where the “genuinely shared items” above fall, per AWS’s page), and customer-specific controls (solely the customer’s responsibility based on the application they deploy, such as data zone security).
- Compliance is shared too — AWS certifies the infrastructure and publishes the evidence through AWS Artifact; proving the workload on top is compliant remains the customer’s job, supported by Amazon Config and AWS Security Hub.
- Penetration testing against your own workloads is permitted for common services, but the customer should still clear it with their internal security team before conducting it.