CLF-C02 Study Notes: AWS Shared Responsibility Model
Task Statement 2.1: Understand the AWS Shared Responsibility Model
What is the shared responsibility model?
The AWS shared responsibility model explains which security tasks are managed by:
- AWS
- The AWS customer
- Both AWS and the customer, depending on the service and configuration
At a high level:
AWS is responsible for security of the cloud.
The customer is responsible for security in the cloud.
The amount of responsibility a customer has depends on the AWS service being used. Generally, the more managed the service is, the fewer infrastructure-management tasks the customer performs.
AWS Responsibilities: Security of the Cloud
AWS is responsible for protecting the infrastructure that runs AWS services. This includes:
- AWS Regions
- Availability Zones
- Edge locations
- Physical data centers
- Physical servers and hardware
- Networking infrastructure
- Storage infrastructure
- Virtualization infrastructure and hypervisors
- The underlying infrastructure used to provide AWS services
- Security and maintenance of the managed service infrastructure
Customers do not manage or physically secure AWS data centers, servers, or networking equipment.
Example
If an Amazon EC2 instance is running in an Availability Zone:
- AWS manages the Region and Availability Zone.
- AWS manages the physical servers and networking.
- AWS manages the hypervisor used to provide virtualization.
- The customer manages the guest operating system and everything above it.
Customer Responsibilities: Security in the Cloud
Customers are responsible for securing the resources and data they configure or deploy in AWS.
Common customer responsibilities include:
- Customer data
- Applications and application code
- Operating systems on services such as Amazon EC2
- User access and permissions
- Identity and Access Management configuration
- Network and firewall configuration
- Security group configuration
- Data encryption configuration
- SSL/TLS certificates and protected network traffic
- Authentication and authorization
- Data backups
- Operating system and application patching where applicable
Customer data
Customers are responsible for:
- Deciding what data to store in AWS
- Controlling access to that data
- Encrypting data when appropriate
- Maintaining backups
- Configuring appropriate security controls
AWS provides security features, but the customer must configure and use them correctly.
Responsibility Depends on the Service
The shared responsibility model is not identical for every AWS service.
General rule
| Service type | AWS generally manages | Customer generally manages |
|---|---|---|
| Infrastructure-oriented service | Physical infrastructure, networking, virtualization | Operating system, applications, data, access, and configuration |
| Managed service | Infrastructure and much of the platform | Data, access, application use, and service configuration |
| Serverless service | Infrastructure, servers, operating system, and runtime platform | Code, permissions, data, and application configuration |
The customer usually has more responsibility with Amazon EC2 and less infrastructure responsibility with managed services such as Amazon RDS, DynamoDB, and Lambda.
Service Responsibility Examples
Amazon EC2
Amazon EC2 provides virtual servers, but the customer manages much of the software environment.
AWS is responsible for:
- Physical servers
- Data centers
- Networking infrastructure
- Storage infrastructure
- Hypervisor
- Underlying virtualization platform
Customer is responsible for:
- Guest operating system
- Operating system patches and updates
- Installed applications
- Application security
- Security group and network configuration
- User access and permissions
- Data and data protection
- Backups
- Encryption configuration
Exam point
If a vulnerability exists in the operating system running on an EC2 instance, the customer is generally responsible for applying the patch.
Amazon RDS
Amazon RDS is a managed database service. AWS manages more of the database infrastructure than it does for EC2.
AWS is responsible for:
- Underlying physical infrastructure
- Operating system management for the managed database environment
- Database engine patching and maintenance according to the service configuration
- Database infrastructure and platform availability
Customer is responsible for:
- Database contents
- Database users and permissions
- Access policies
- Network configuration
- Instance and backup configuration
- Encryption choices and other security settings
- Application-level security
Exam point
If the same MySQL database is deployed using:
- Amazon RDS: AWS manages database engine patching.
- Amazon EC2: The customer manages the operating system and database engine patching.
Amazon DynamoDB
Amazon DynamoDB is a fully managed NoSQL database service.
AWS is responsible for:
- Servers and physical infrastructure
- Operating system and database platform
- Service availability and underlying maintenance
Customer is responsible for:
- Data stored in DynamoDB
- IAM permissions and access control
- Table and application configuration
- Encryption-related configuration where applicable
- Application security
- Backup and recovery choices
Customers do not manage the DynamoDB servers or operating system.
AWS Lambda
AWS Lambda is a serverless compute service.
AWS is responsible for:
- Physical infrastructure
- Servers
- Operating systems
- Runtime infrastructure
- Scaling infrastructure
- Underlying service maintenance
Customer is responsible for:
- Lambda function code
- Function dependencies
- Execution role and permissions
- Environment variables and configuration
- Data processed by the function
- Application security
- Secure handling of credentials and sensitive data
Customers do not patch the servers or operating systems used to run Lambda functions.
Comparing Similar Services
Amazon EC2 vs. Amazon RDS
| Area | Amazon EC2 | Amazon RDS |
|---|---|---|
| Service type | Infrastructure-oriented virtual server | Managed relational database |
| Customer manages OS? | Yes | No |
| Customer patches database engine? | Generally yes | AWS manages database engine patching |
| Customer manages applications? | Yes | Customer manages applications that use the database |
| Customer manages data and access? | Yes | Yes |
Amazon EC2 vs. AWS Lambda
| Area | Amazon EC2 | AWS Lambda |
|---|---|---|
| Servers | Customer uses and manages virtual server environment | AWS manages servers |
| Operating system | Customer responsibility | AWS responsibility |
| Application code | Customer responsibility | Customer responsibility |
| Scaling infrastructure | Customer configures/manages scaling | AWS manages the underlying scaling infrastructure |
| Permissions and data | Customer responsibility | Customer responsibility |
Key comparison
EC2 gives the customer more control and therefore more responsibility.
Managed and serverless services reduce infrastructure-management responsibilities, but customers remain responsible for their data, permissions, code, and configuration.
Important Exam Traps
Trap 1: “AWS manages everythingâ€
Incorrect. AWS manages the underlying cloud infrastructure, but customers still manage:
- Data
- IAM permissions
- Applications
- Service configuration
- Encryption choices
- Operating systems on EC2
Trap 2: Confusing physical security with data security
- AWS secures the physical data centers and hardware.
- The customer secures the data stored and processed in AWS.
If asked who secures the AWS data centers, the answer is AWS.
Trap 3: Assuming patching responsibility is always AWS’s
Patching responsibility depends on the service:
- EC2 operating system and database software: Customer
- RDS database engine and managed platform: AWS
- Lambda servers and runtime infrastructure: AWS
- Customer application code and dependencies: Customer
Trap 4: Believing managed services eliminate all customer security work
Managed services reduce infrastructure-management tasks, but customers still need to configure:
- IAM permissions
- Network access
- Encryption
- Backups
- Application access
- Data protection
Trap 5: Confusing AWS security controls with customer configuration
AWS provides security features such as encryption, IAM, and network controls. The customer is responsible for configuring and using those features correctly.
Exam Tips
-
Remember the phrase:
Security of the cloud = AWS
Security in the cloud = Customer -
Look for the service abstraction level.
- EC2: more customer responsibility
- RDS: AWS manages more of the database platform
- Lambda: AWS manages servers and operating systems
-
DynamoDB: AWS manages the database infrastructure
-
Physical infrastructure questions usually point to AWS. Data centers, physical servers, hardware, and the underlying network are AWS responsibilities.
-
Data and access questions usually point to the customer. Customers are responsible for their data, IAM permissions, application access, and backups.
-
For patching questions, identify what is being patched.
- EC2 operating system: customer
- RDS database engine: AWS
- Lambda infrastructure: AWS
- Customer code or dependencies: customer
Example Questions and Answers
Question 1
Which statement best describes the AWS shared responsibility model?
A. AWS is responsible for all security tasks in the AWS Cloud.
B. The customer is responsible for securing AWS data centers.
C. AWS is responsible for security of the cloud, and the customer is responsible for security in the cloud.
D. The customer is responsible only for application code.
Answer: C
Explanation: AWS secures the underlying cloud infrastructure. Customers secure their data, applications, identities, and configurations within AWS.
Question 2
Who is responsible for securing the physical data centers that host AWS services?
A. The AWS customer
B. AWS
C. The customer’s application team
D. A third-party auditor
Answer: B
Explanation: AWS is responsible for physical security of its data centers, hardware, and underlying infrastructure.
Question 3
A company runs a MySQL database on an Amazon EC2 instance. Who is responsible for applying security patches to the database software?
A. AWS
B. The customer
C. The database software vendor only
D. The AWS data center operator
Answer: B
Explanation: On EC2, the customer manages the operating system and software installed on the instance, including the database engine.
Question 4
A company uses Amazon RDS for MySQL. Who is responsible for patching the underlying managed database engine?
A. The customer
B. AWS
C. The application developer only
D. The network administrator
Answer: B
Explanation: Amazon RDS is a managed service. AWS manages the underlying database platform and database engine patching. The customer remains responsible for data, permissions, configuration, and application security.
Question 5
Which task remains the customer’s responsibility when using AWS Lambda?
A. Replacing physical servers
B. Patching the Lambda operating system
C. Securing the Lambda function code and execution permissions
D. Managing the AWS data center
Answer: C
Explanation: AWS manages the servers, operating systems, and runtime infrastructure. The customer is responsible for function code, permissions, configuration, and data.
Question 6
Which responsibility generally belongs to the customer when using Amazon DynamoDB?
A. Maintaining the physical servers
B. Patching the database operating system
C. Managing the DynamoDB service infrastructure
D. Configuring access permissions to the stored data
Answer: D
Explanation: DynamoDB is fully managed by AWS, but customers are responsible for data access, IAM permissions, and application configuration.
Summary
- AWS manages the security of the cloud.
- Customers manage the security of their resources and data in the cloud.
- AWS secures:
- Data centers
- Physical hardware
- Networking infrastructure
- Regions and Availability Zones
- Managed service infrastructure
- Customers secure:
- Data
- Applications and code
- IAM permissions
- Network and firewall configuration
- Encryption settings
- Backups
- Operating systems and software on EC2
- Responsibility shifts based on the service:
- EC2: Customer manages the operating system and installed software.
- RDS: AWS manages the database platform and engine patching.
- DynamoDB: AWS manages the database infrastructure.
- Lambda: AWS manages servers and operating systems; the customer manages code, permissions, and data.