AWS Shared Responsibility Model¶

Overview¶

The AWS Shared Responsibility Model is a security and compliance framework that delineates the security responsibilities of AWS versus those of the customer. This model helps relieve customer's operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities.

Core Concept¶

"Security OF the Cloud" vs "Security IN the Cloud"¶

• AWS Responsibility: "Security OF the Cloud"
• Physical infrastructure
• Global infrastructure

• Hardware and software that runs AWS services

• Customer Responsibility: "Security IN the Cloud"

• Customer data
• Platform, applications, and identity & access management
• Operating system, network, and firewall configuration

AWS Responsibilities (Security OF the Cloud)¶

Physical and Environmental Security¶

• Data Centers: Physical access control and security
• Hardware: Server hardware and networking equipment
• Environmental Controls: Power, cooling, and fire suppression
• Physical Disposal: Secure hardware disposal and destruction

Infrastructure Security¶

• Global Infrastructure: Regions, Availability Zones, Edge Locations
• Compute Infrastructure: Physical servers and hypervisors
• Storage Infrastructure: Physical storage systems
• Network Infrastructure: Routers, switches, load balancers

Service Security¶

• Managed Services: Security of the service itself
• API Endpoints: Security of AWS API endpoints
• Service Communications: Inter-service communication security
• Software Updates: Patching and updating AWS services

Compliance and Governance¶

• Certifications: SOC ½/3, PCI DSS, FedRAMP, HIPAA
• Audits: Third-party security audits and assessments
• Compliance Reports: Available through AWS Artifact
• Security Standards: Implementation of security frameworks

Customer Responsibilities (Security IN the Cloud)¶

Data Protection¶

• Data Classification: Identifying and classifying data
• Data Encryption: Encrypting data at rest and in transit
• Data Backup: Implementing backup and retention policies
• Data Location: Choosing appropriate AWS Regions

Identity and Access Management¶

• User Management: Creating and managing user accounts
• Access Controls: Implementing least privilege access
• Authentication: Multi-factor authentication (MFA)
• Authorization: Role-based access control (RBAC)

Network Security¶

• Security Groups: Configuring virtual firewalls
• Network ACLs: Subnet-level network controls
• VPC Configuration: Virtual Private Cloud setup
• Network Monitoring: Traffic analysis and logging

Operating System and Applications¶

• OS Updates: Patching guest operating systems
• Application Security: Securing applications and workloads
• Antivirus: Installing and maintaining security software
• Host-based Firewalls: Configuring local firewalls

Service-Specific Responsibilities¶

Infrastructure Services (IaaS)¶

Examples: EC2, EBS, VPC

AWS Responsibilities:¶

• Physical hardware and hypervisor
• Network controls and host operating system patches
• Physical access to facilities

Customer Responsibilities:¶

• Guest operating system updates and patches
• Application software updates and patches
• Security group and firewall configuration
• Network and access configuration

Container Services¶

Examples: ECS, EKS, Fargate

AWS Responsibilities:¶

• Container hosting environment
• Underlying infrastructure
• Service availability

Customer Responsibilities:¶

• Container images and contents
• Application code security
• Network controls and access management
• Container configuration

Abstracted Services (PaaS)¶

Examples: RDS, Lambda, Elastic Beanstalk

AWS Responsibilities:¶

• Operating system and platform management
• Database software patching (RDS)
• Runtime environment (Lambda)
• Service scaling and availability

Customer Responsibilities:¶

• Application code
• Data and content
• Access management
• Database user accounts and permissions

Managed Services (SaaS)¶

Examples: S3, DynamoDB, AWS SES

AWS Responsibilities:¶

• Service functionality and availability
• Infrastructure and platform management
• Software updates and patches
• Service scaling

Customer Responsibilities:¶

• Data uploaded to the service
• Access and permissions configuration
• Usage configuration
• Integration with other services

Security Controls by Service Type¶

Compute Services¶

EC2 (Virtual Machines)¶

• AWS: Physical hosts, hypervisor, network isolation
• Customer: Guest OS, applications, data, network traffic protection

Lambda (Serverless)¶

• AWS: Runtime environment, execution isolation, scaling
• Customer: Function code, data processing, access controls

ECS/EKS (Containers)¶

• AWS: Host OS, container service, API endpoints
• Customer: Container images, application security, task definitions

Storage Services¶

S3 (Object Storage)¶

• AWS: Storage infrastructure, durability, availability, service features
• Customer: Data encryption, bucket policies, access controls, data classification

EBS (Block Storage)¶

• AWS: Storage infrastructure, replication within AZ, snapshot encryption
• Customer: Data on volumes, encryption configuration, access management

EFS (File System)¶

• AWS: File system infrastructure, availability, backup service
• Customer: Data stored, encryption settings, access points, file permissions

Database Services¶

RDS (Managed Database)¶

• AWS: DB software, OS patching, hardware, automated backups
• Customer: Database user management, data, network access, parameter groups

DynamoDB (NoSQL Database)¶

• AWS: Database software, infrastructure, scaling, availability
• Customer: Data, access patterns, encryption settings, access controls

Network Services¶

VPC (Virtual Private Cloud)¶

• AWS: Network infrastructure, physical network devices
• Customer: VPC configuration, subnets, routing tables, security groups

CloudFront (CDN)¶

• AWS: Edge infrastructure, caching service, DDoS protection
• Customer: Content, access controls, origin security, SSL certificates

Compliance Considerations¶

Shared Compliance Responsibilities¶

• AWS: Infrastructure compliance (SOC, PCI, HIPAA eligible)
• Customer: Application and data compliance
• Both: Ongoing monitoring and incident response

Compliance Programs¶

• AWS Compliance: Infrastructure meets various standards
• Customer Compliance: Applications must be configured compliantly
• Audit Requirements: Customers may need to audit their implementations

Best Practices for Customers¶

Security Implementation¶

1. Principle of Least Privilege: Grant minimum necessary permissions
2. Defense in Depth: Multiple layers of security controls
3. Regular Updates: Keep systems and applications updated
4. Monitoring and Logging: Implement comprehensive monitoring

Data Protection¶

1. Encryption: Encrypt sensitive data at rest and in transit
2. Access Controls: Implement strong access management
3. Backup: Regular backups with tested restoration procedures
4. Classification: Classify data based on sensitivity

Network Security¶

1. Security Groups: Configure restrictive security group rules
2. Network Segmentation: Use subnets to segment workloads
3. Monitoring: Monitor network traffic and access patterns
4. VPN/Direct Connect: Secure connectivity for hybrid architectures

Identity and Access Management¶

1. IAM Policies: Use managed policies where possible
2. Multi-Factor Authentication: Enable MFA for all users
3. Regular Review: Regularly review and audit access permissions
4. Service Accounts: Use IAM roles instead of long-term access keys

Common Misconceptions¶

AWS is Responsible for Everything¶

• Reality: Customers have significant security responsibilities
• Implication: Customers must actively configure and manage security

Customer Data is Automatically Encrypted¶

• Reality: Encryption must be explicitly configured
• Implication: Customers must choose and configure encryption options

AWS Manages All Updates¶

• Reality: Customer applications and OS updates are customer responsibility
• Implication: Customers must maintain patching schedules

Security Groups are Automatically Configured¶

• Reality: Customers must configure appropriate rules
• Implication: Default rules may be too permissive

Tools for Managing Responsibilities¶

AWS Tools¶

• AWS Config: Configuration compliance monitoring
• AWS CloudTrail: API call logging and monitoring
• AWS Security Hub: Centralized security findings
• AWS Inspector: Application security assessment
• AWS GuardDuty: Threat detection service

Customer Tools¶

• Third-party Security Tools: Complement AWS native tools
• Monitoring Solutions: Custom monitoring and alerting
• Compliance Frameworks: Industry-specific compliance tools
• Automation Tools: Infrastructure as Code for consistency

Key Takeaways¶

1. Shared Model: Security is a shared responsibility between AWS and customers
2. Clear Boundaries: AWS secures the infrastructure, customers secure their workloads
3. Service Dependent: Responsibilities vary by service type (IaaS, PaaS, SaaS)
4. Customer Controls: Customers have significant control and responsibility
5. Compliance: Both parties contribute to overall compliance posture
6. Documentation: AWS provides clear documentation of responsibilities
7. Tools Available: Many tools available to help manage responsibilities
8. Ongoing Process: Security is an ongoing process, not a one-time setup