The Shared Responsibility Model
Understand the AWS shared responsibility model
What you will learn
- Explain the difference between "security of the cloud" and "security in the cloud."
- Determine who owns a given layer's responsibility (physical infrastructure, OS, data, network) for a specific service.
- Contrast an unmanaged service like EC2 with a managed one like RDS in terms of how responsibility is split.
- Avoid the wrong assumption that managed services free the customer from all security responsibility.
The shared responsibility model splits security into two non-overlapping halves: AWS is responsible for the security OF the cloud — physical hardware, data centers, the virtualization layer, AWS's global network. The customer is always responsible for security IN the cloud — their data, classifying it, controlling who can access it, and configuring every service they use securely. This split never changes in principle, but how much falls on each side shifts by service.
Who does what
| AWS | Customer | |
|---|---|---|
| Facilities and physical data centers | Full responsibility | No access, no responsibility at all |
| The virtualization layer (hypervisor) | Full responsibility | Not even visible to them |
| The EC2 instance's OS and its patches | Does not touch it | Full responsibility — patch manually or via a management tool |
| Configuring security groups and IAM | Provides the tool and the service | Configures it correctly — a misconfiguration is theirs alone |
| Classifying and encrypting data | Provides the encryption tools (e.g., KMS) | Decides what gets encrypted, when, and manages their keys |
A managed service: Amazon RDS
In RDS, AWS manages patching the database engine, automated backups, and the underlying infrastructure — much more than it does for plain EC2. But the customer is still responsible for configuring access rules (who can connect to the database), classifying sensitive data inside it, and managing connection credentials. A managed service shifts more of the technical burden, not all of the security responsibility.
What matters on the exam
- Quick rule: the more "managed" a service is by AWS, the larger AWS's share of responsibility — but the customer's responsibility over their data and configuration never disappears.
- Scenario questions describe an incident (a data leak, a breach) and ask "who is responsible?" — the answer always depends on which layer failed.
A common mistake
The most common wrong assumption: "I used a managed service, so AWS is responsible for everything." This is never fully true — even in the most managed services, classifying data and controlling who can access it remains the customer's responsibility alone, and no service exempts them from that part.
Quick check
Answer in your head first, then reveal.
Who secures AWS's physical data centers?Reveal the answer
AWS alone — the customer has no access at all.
Who patches an EC2 instance's operating system?Reveal the answer
The customer — this is not part of AWS's responsibility on EC2.
Does using a managed service like RDS exempt the customer from controlling access to their data?Reveal the answer
No — classifying data and controlling access to it always remains the customer's responsibility.
What is the model's named dividing line?Reveal the answer
Security OF the cloud (AWS) versus security IN the cloud (the customer).
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.