Content Domain 2: Security and Compliance

Task Statement 2.1: Understand the AWS shared responsibility model

Let's get started with the first task statement for domain 2, which is to understand the AWS shared responsibility model. In domain 1, we discussed AWS as cloud computing and also introduced the AWS global infrastructure. In this lesson, we will take it a step farther and discuss the AWS shared responsibility model. So what is the AWS shared responsibility model? Well, the AWS shared responsibility model is how AWS provides clarity around which areas of system security belongs to AWS and which belongs to the customer. AWS provides the shared responsibility model so you are clear about which elements of the infrastructure AWS manages and what elements customers are responsible for managing. At a very high level, AWS is responsible for the security of the cloud, but you are responsible for the security of your data, applications and so on in the cloud. If you look at our diagram with the AWS global infrastructure on the bottom, you'll also see different service levels on top of that global infrastructure. There are Regions, Availability Zones, and edge locations around the world. And on top of that, we have the AWS global infrastructure. AWS manages all of this, the hardware, the security, and more for this global infrastructure. And you, as the AWS customer, have no control over any of this and you don't have to worry about this infrastructure. Now, we can add in the next level of the global infrastructure, and that is the levels of compute, storage, networking, databases, and so on. AWS is again responsible for managing these and the security of these services and systems. There is another level that AWS manages and that is the software that assists any of the levels of services below it. So AWS manages the Regions, the global infrastructure, the hardware, the network, and the level services like compute, databases, network, storage, and more, and also any software that is used to provide these services. For example, if you choose to provision an Amazon EC2 instance from the AWS compute level, AWS manages the Region and the Availability Zone that your Amazon EC2 instance will run in. AWS handles the provisioning and the security, compute, networking, and storage needed for this instance and also handles the software for the instance such as the user interface or the hypervisor. Now, this is where your responsibility comes in. You are responsible for the operating system and upwards. So that would be things like client-side data encryption, integrity, authentication, server-side encryption, and protecting the network traffic. And that includes encrypting your data using SSL certificates and so on. You are responsible for all of this as well as the operating system and the network and firewall configurations. You are responsible for your application and your identity access management, so you allow people to have certain access to your account and the services in that account. You are also responsible for your customer data, securing that data and definitely backups of that data. Being a cloud practitioner means you should be able to determine when you need to secure resources in AWS and the depth to which you need to be involved for security which can vary from service to service. Another example is who is responsible for securing the data centers that host AWS services? In this case, the answer is AWS and not the customer. This is the level of determination you need to be able to make regarding the AWS shared responsibility model. You should also be able to describe how a customer's responsibility shifts depending on the service they are using. For example, let's say you're hosting a MySQL database on Amazon RDS, are you responsible for patching the database engine on an Amazon RDS database instance or is AWS responsible for this security patching? What if you have the same database running on an Amazon EC2 instance? Who would be responsible for patching in that use case? The answer to these two questions is that AWS is responsible for patching on Amazon RDS whereas you, the customer, are responsible for patching on Amazon EC2. The task you are responsible for with regards to security depends on if an AWS service is managed or not. In the previous example, Amazon RDS is a managed service so you are required to carry out less of the security and management tasks in general. However, Amazon EC2 is unmanaged, meaning you have more control over the service and are therefore more responsible for carrying out security and management tasks. The key takeaway here is the level of responsibility the customer assumes changes depending on the service they're using. It is important to know for the exam what the customer versus AWS is responsible for for services such as Amazon RDS, Amazon EC2, Amazon DynamoDB, and AWS Lambda just to name a few. Let's get started with the second task statement and talk about cloud security governance and compliance.