AWS Fundamentals
The AWS Shared Responsibility Model Explained: Security of the Cloud vs Security in the Cloud
Under the AWS shared responsibility model, AWS is responsible for security of the cloud: the hardware, software, networking and facilities that run AWS services. You are responsible for security in the cloud, and how much that includes depends on the services you choose.
Security of the cloud vs security in the cloud
| AWS: security "of" the cloud | Customer: security "in" the cloud | |
|---|---|---|
| Scope | Protecting the infrastructure that runs all the services offered in the AWS Cloud: the hardware, software, networking and facilities. | Determined by the AWS services you select, which sets how much configuration work you must do as part of your security responsibilities. |
| Example | The infrastructure under Amazon EC2. | Amazon EC2 is Infrastructure as a Service (IaaS), so you perform all the necessary security configuration and management tasks for your instances. |
Source: aws.amazon.com/compliance/shared-responsibility-model/
The more of the stack AWS manages for a service, the less configuration you carry. The split changes service by service, which is why exam questions often hinge on which service the scenario uses.
Three kinds of controls
| Type | What it means | Example from AWS |
|---|---|---|
| Inherited controls | Controls you fully inherit from AWS. | Physical and environmental controls. |
| Shared controls | Controls that apply to both the infrastructure layer and the customer layer, in completely separate contexts. AWS provides the requirements for the infrastructure, and you provide your own control implementation within your use of AWS services. | Patch management, configuration management, awareness and training. |
| Customer-specific controls | Controls that are solely your responsibility, based on the application you deploy within AWS services. | Service and communications protection or zone security, such as routing or zoning data within specific security environments. |
Source: aws.amazon.com/compliance/shared-responsibility-model/
Shared controls in practice
- Patch management. AWS is responsible for patching and fixing flaws within the infrastructure. You are responsible for patching your guest operating system and applications.
- Configuration management. AWS maintains the configuration of its infrastructure devices. You are responsible for configuring your own guest operating systems, databases and applications.
- Awareness and training. AWS trains AWS employees, and you must train your own employees.
How to apply the model
AWS suggests a few practical steps once you understand the model:
- Review third-party audit attestation documents to see which controls you inherit and which remain for you to implement.
- Give your internal and external audit teams cloud-specific learning, such as the Cloud Audit Academy programs.
- Run a Well-Architected Review of your workloads to evaluate security, reliability and performance practices.
Why it matters for AWS exams
The model is foundational. It is Task 2.1 of the Security and Compliance domain of AWS Certified Cloud Practitioner, which is 30% of that exam (see the Cloud Practitioner exam guide). The skills AWS lists include describing the customer's responsibilities, AWS responsibilities and shared responsibilities, and describing how those responsibilities can shift depending on the service used. The AWS Certified Security – Specialty guide lists "the AWS shared responsibility model and its application" among the recommended knowledge; see the SCS-C03 exam guide and Domain 6: Governance.
Frequently asked questions
Who is responsible for patching the operating system on an EC2 instance?
You are. AWS patches the infrastructure, but customers are responsible for patching their guest operating system and applications.
Is physical security of data centers my responsibility?
No. Physical and environmental controls are inherited controls: you inherit them fully from AWS.
Does the split of responsibilities change by service?
Yes. Your responsibility is determined by the AWS services you select, which sets the amount of configuration work you must perform.
What is a shared control?
A control that applies to both the infrastructure layer and the customer layer, in separate contexts. AWS provides the infrastructure requirements and you provide your own implementation.
Sources
- AWS Shared Responsibility Model (AWS)
- AWS Certified Cloud Practitioner exam guide (AWS)
- AWS Certified Security – Specialty exam guide (AWS)
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Certifications
AWS Cloud Practitioner (CLF-C02) Exam Guide: Cost & Domains
CLF-C02 at a glance: 65 questions, 90 minutes, 700 to pass, 100 USD, four domains with weights, and who the exam is for.
2 min read - Certifications
Which AWS Certification First? A Simple Decision Guide
No idea where to start? Match your background to the right AWS certification level, from Cloud Practitioner to Specialty, using AWS's own guidance.
2 min read - Security Specialty
SCS-C03 In-Scope AWS Services: The Official List
Every AWS service on the Security Specialty exam, grouped by category, plus what is out of scope and the concepts AWS says to know.
2 min read