AWS Shared Responsibility Model
Shared Responsibility Model
The AWS Shared Responsibility Model is a foundational framework that defines exactly which security and operational tasks belong to Amazon Web Services and which tasks belong to you, the customer.
The easiest way to remember this model is through a single core rule: AWS is responsible for the security of the cloud, while the customer is responsible for the security in the cloud.
1. AWS Responsibility: Security OF the Cloud
AWS is responsible for protecting the entire underlying global infrastructure that runs all of the services offered in their catalog.
Physical Security: Securing the actual data centers, buildings, and facilities with guards, cameras, biometric locks, and environmental controls (power, cooling, and fire suppression).
Hardware Infrastructure: Managing, repairing, and replacing physical bare-metal servers, storage arrays, and fiber-optic networking switches.
The Virtualization Layer: Managing and securing the hypervisor software that slices up physical server hardware into smaller, isolated virtual machines.
2. Customer Responsibility: Security IN the Cloud
You are entirely responsible for what you put inside AWS and how you configure the services you spin up.
Customer Data: Classifying your data, configuring data encryption at rest (using tools like AWS Key Management Service), and enforcing data encryption in transit (using SSL/TLS certificates).
Identity and Access Management (IAM): Creating users, managing API keys, assigning passwords, writing strict permission policies, and enforcing Multi-Factor Authentication (MFA).
Operating System & Applications: If you launch a virtual machine, you are responsible for updating its software, applying security patches, and writing your own secure application code.
Network Traffic: Configuring firewall rules (called Security Groups and Network ACLs) to decide exactly which IP addresses are allowed to access your applications.
The Gold Standard Rule: If an S3 bucket is left open to the public and sensitive company logs are exposed, AWS did not fail.
The AWS infrastructure remained secure, but the customer failed their responsibility to configure the access policies correctly.
3. Shared Controls
Some responsibilities apply to both layers but in completely different contexts:
Patch Management: AWS is responsible for patching flaws within the physical infrastructure and host operating systems.
The customer is responsible for patching their own guest operating systems, databases, and installed runtimes (like Node.js). Configuration Management: AWS maintains the configuration of its physical infrastructure devices.
The customer is responsible for configuring their own databases, networks, and applications. Awareness & Training: AWS trains its own internal data center employees. The customer is responsible for training their own internal development teams on cloud security best practices.
4. How Responsibilities Shift by Service Type
Your exact day-to-day security workload changes dramatically depending on whether you use raw infrastructure or managed cloud platforms: