AWS Builder Center

Builder Center

AWS Shared Responsibility Model

The AWS Shared Responsibility Model divides security responsibilities between AWS and the customer. AWS secures the cloud. You secure what you put in the cloud.

AWS Shared Responsibility Model

Understanding what AWS secures — and what you still need to secure

When people first move from traditional servers to AWS, one common question is:
“If AWS is managing my cloud infrastructure, does AWS manage all the security too?”
The answer is no.
AWS and the customer share security responsibilities. This is known as the AWS Shared Responsibility Model.
Understanding this model is important because using AWS does not automatically make an application secure.

What is the Shared Responsibility Model?

The AWS Shared Responsibility Model divides security responsibilities between AWS and the customer.
A simple way to remember it is:
AWS secures the cloud. You secure what you put in the cloud.
AWS calls these:
  • Security of the Cloud → AWS responsibility
  • Security in the Cloud → Customer responsibility

What does AWS secure?

AWS is responsible for the underlying infrastructure that runs AWS services.
This includes things such as:
  • Physical data centers
  • Physical hardware
  • Networking infrastructure
  • AWS facilities
  • Underlying infrastructure and virtualization
For example, if you run an application on an Amazon EC2 instance, you don't need to worry about physically protecting the AWS data center or maintaining the physical server hardware. AWS handles those infrastructure responsibilities.
Think of it like renting an apartment.
AWS provides and protects the building.

What does the customer secure?

You are responsible for security inside your AWS environment, according to the services you use.
Depending on the service, this can include:
  • Your data
  • IAM permissions
  • Application security
  • Operating system updates
  • Security group configuration
  • Encryption settings
  • Access controls
The exact responsibility changes depending on the AWS service.

A Simple EC2 Example

Imagine you launch an Amazon EC2 instance and install a web application.
The responsibility can be simplified like this:
AWS is responsible forYou are responsible for
Physical serversYour application
Data center securityYour operating system
Physical networkingOS security patches
Underlying infrastructureSecurity group configuration
Virtualization infrastructureUser permissions
AWS facilitiesYour data
For EC2, the customer has significant responsibility because EC2 is an infrastructure service. AWS manages the underlying infrastructure, while the customer manages the guest operating system, applications, and relevant security configuration.

What about Amazon S3?

Now consider Amazon S3.
With S3, AWS manages much more of the underlying infrastructure and platform.
But that doesn't mean your S3 data automatically has the correct permissions.
You still need to think about:
  • Who can access your bucket?
  • What permissions do they have?
  • Should your data be encrypted?
  • Is public access really required?
  • Which IAM identities can access the data?
AWS manages the underlying S3 infrastructure, while customers remain responsible for their data, permissions, and relevant security configurations.

EC2 vs S3: Why does responsibility change?

This is one of the most important things to understand.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
MORE CUSTOMER MANAGEMENT
↑
|
Amazon EC2
|
Operating System
Applications
Security Config
|
|
Amazon S3
|
AWS manages more layers
↓
MORE AWS MANAGEMENT
The more infrastructure you manage yourself, the more security responsibilities you generally have.
When you choose more abstracted AWS services, AWS manages more of the underlying layers.

A Simple Real-World Analogy

Think about staying in a hotel.
Hotel management = AWS
The hotel is responsible for:
  • Building security
  • Electricity infrastructure
  • Physical facilities
  • Maintaining the building

Guest = Customer

You are responsible for:
  • Your belongings
  • Locking your room
  • Who you give your room key to
  • How you use the room
AWS provides a secure cloud infrastructure, but you still need to configure and use AWS services securely.

A Common Misunderstanding

A common mistake is thinking:
“My application is hosted on AWS, so AWS is responsible for securing my application.”
Not necessarily.
AWS can provide secure infrastructure, but you can still create security problems through your own configuration.
For example:
1
2
3
4
5
6
7
8
9
10
Secure AWS Infrastructure
↓

Incorrect IAM permissions
↓

Publicly accessible data
↓

Security risk
The infrastructure can be secure while the customer's configuration is not.
AWS specifically notes that customer responsibilities vary depending on the services selected, how those services are integrated, and the applicable requirements.

Final Thought

Moving to the cloud doesn't mean handing over all security responsibilities.
Instead, AWS and the customer work together:
AWS provides the secure foundation. You are responsible for securely building on it.
Once you understand this model, services such as IAM, EC2, S3, VPC, CloudTrail, and security groups become much easier to understand from a security perspective.
#aws #cloud-computing #aws-security #shared-responsibility #cloud-security

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article