Shared Responsibility Model
AWS secures the cloud itself; you are responsible for securing what you put in the cloud.
Security on AWS is a partnership described by the Shared Responsibility Model. Drawing the line clearly prevents dangerous gaps.
AWS is responsible for "security OF the cloud"
- Physical data centers and hardware.
- The global network and the hypervisor.
- Managed-service software (e.g. the RDS engine).
You are responsible for "security IN the cloud"
- Your data and its encryption.
- IAM — users, roles and permissions.
- Operating system and application patching on EC2.
- Network configuration — security groups, firewall rules.
The exact split shifts by service type. With a managed service like Lambda, AWS handles more; with raw EC2, you handle the whole operating system.
Example
# Your responsibility: make sure a bucket is NOT publicly readable
aws s3api get-public-access-block --bucket my-app-assets
# Your responsibility: keep the OS on an EC2 instance patched
# (run inside the instance)
sudo yum update -yWhen to use it
- AWS patches the hypervisor under EC2 instances (AWS responsibility), while the customer must patch the OS running on those instances.
- A company must enable S3 bucket encryption with SSE-KMS (customer responsibility), even though AWS physically secures the storage hardware.
- AWS ensures the DynamoDB service stays globally available (AWS responsibility), while the customer controls who has IAM access to their tables.
More examples
Patch EC2 OS (Customer Responsibility)
Demonstrates the customer's responsibility by applying security patches to the EC2 OS, something AWS never manages.
# AWS manages the hypervisor; you own the OS patches
ssh -i my-key.pem [email protected] \
'sudo yum update -y --security'Enable S3 Bucket Encryption
Enforces encryption-at-rest on an S3 bucket, illustrating the customer responsibility for protecting data in the cloud.
aws s3api put-bucket-encryption \
--bucket my-bucket \
--server-side-encryption-configuration '{
"Rules": [{
"ApplyServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}]
}'Audit IAM Credential Report
Generates the IAM credential report, which customers must review regularly to find unused keys and missing MFA.
# Customers own access control — generate and review the credential report
aws iam generate-credential-report
aws iam get-credential-report \
--query 'Content' \
--output text | base64 -d | cut -d, -f1,4,5,10
Discussion