The AWS shared responsibility model

Security is shared. AWS is responsible for security OF the cloud; you are responsible for security IN the cloud. Where the line falls depends on how managed the service is.

Who does what

• AWS (security of the cloud): Physical data centers, hardware, the global network, and the virtualization layer, plus the software that runs managed services.
• Customer (security in the cloud): Your data, identity and access management, encryption choices, network and firewall configuration (security groups, NACLs), and the guest operating system and applications when you manage them.
• Shared controls: Patch management, configuration management, and awareness and training apply to both: AWS handles its infrastructure, you handle your guest OS, apps, and people.

How the line shifts by service

• Amazon EC2 (infrastructure as a service): You manage the guest OS (including patches), installed software, security groups, and data. AWS manages the host and hypervisor.
• Amazon RDS (managed database): AWS patches the database engine and OS and handles backups infrastructure. You manage database users, network access, encryption settings, and your data.
• AWS Lambda (serverless): AWS manages servers, OS, and runtime patching. You manage your function code, its IAM permissions, and your data.
• Amazon S3 and Amazon DynamoDB (abstracted services): AWS runs the entire platform. You decide who can access buckets, tables, and items, whether data is public, and how it is encrypted and classified.

A quick way to reason about it

• Ask: 'Could the customer even touch this?' If not (cables, hosts, hypervisors, facilities), it's AWS's job.
• The more managed the service, the less the customer manages: EC2 (most customer work) → RDS and Elastic Beanstalk → Lambda, S3, and DynamoDB (least).
• Security group and network ACL rules, IAM policies, MFA, and encryption settings are customer configuration, even though AWS provides the features.
• AWS's side of the model is verified by third-party auditors; customers can download those audit reports from AWS Artifact.