AWS shared responsibility model
- The split
- AWS is responsible for security of the cloud — the physical hardware, data centers, the global infrastructure (Regions, Availability Zones, Edge Locations), and the virtualization layer.
- The customer is responsible for security in the cloud — data, configuration, and access.
- Always the customer’s, no matter the service
- Your data, its classification, and encryption choices.
- Identity and access management: users, roles, policies, MFA, least privilege.
- Which resources are public, and what security groups and network ACLs allow.
- Always AWS’s
- Physical security, hardware disposal, host hypervisor, network infrastructure, and the availability of the underlying facilities.
- The line moves with the service model
- Amazon EC2 — customer patches guest OS, firewall, application, and data.
- Amazon RDS — AWS patches OS and DB engine; customer handles schema, users, network access, and data.
- AWS Lambda / Amazon S3 — AWS handles everything below the application; customer handles code, IAM policies, and bucket configuration.
- Shared controls
- Patch management, configuration management, and awareness training — each side does its own layer.
- Where to verify AWS’s half
- AWS Artifact — download AWS’s SOC, ISO, and PCI reports.