Whose job is it?

Security OF the cloud vs security IN the cloud

The AWS shared responsibility model splits security work between AWS and the customer. AWS is responsible for security of the cloud: the buildings, hardware, network and software that run AWS services. The customer is responsible for security in the cloud: what they put in AWS and how they configure it. Think of a rented kennel: the owner keeps the walls and locks sound; you decide who gets a key and you look after your own dog.

Exam tip Memory hook: AWS = OF, customer = IN. If a question says "physical", "facilities" or "hypervisor", it's AWS.

What AWS is responsible for

AWS protects the infrastructure every customer shares.

• Physical security of data centers: guards, cameras, access control
• Hardware: servers, storage, networking gear, and disposing of old disks securely
• The global infrastructure: Regions, Availability Zones and edge locations
• The virtualization layer (hypervisor) that separates one customer's servers from another's
• The software that runs managed services, such as the operating system under Amazon Relational Database Service (Amazon RDS) or AWS Lambda

What the customer is responsible for

The customer protects everything it builds and stores in AWS.

• Customer data, including classifying it and choosing to encrypt it
• Identity and access: users, passwords, multi-factor authentication (MFA), permissions (IAM)
• On virtual servers such as Amazon Elastic Compute Cloud (Amazon EC2): the guest operating system (OS), its patches and the apps on it
• Network and firewall settings, such as security group rules
• Encryption choices: client-side and server-side encryption, and protecting data in transit

Priya: Data and access are always ours. Always. No service changes that.

Some controls belong to both

A few controls are shared controls: each side does its own part, in its own layer.

• Patch management: AWS patches the infrastructure; the customer patches its guest operating systems and apps
• Configuration management: AWS configures its infrastructure devices; the customer configures its own OS, databases and apps
• Awareness and training: AWS trains AWS staff; the customer trains its own staff

Inherited controls

Some controls the customer simply inherits from AWS, such as physical and environmental controls (fire suppression, power, flood protection). Kibble & Co. can point an auditor to AWS's reports for those instead of proving them itself. You'll see where to get those reports soon.

Exam tip Trap: patching is shared, not "all AWS". The exam often asks who patches the guest OS on an EC2 instance: that's the customer.

Amazon EC2: you manage the most

Amazon Elastic Compute Cloud (Amazon EC2) gives you virtual servers. AWS secures the hardware and hypervisor. Everything from the guest operating system up is yours: patches, installed software, the app, firewall rules, data. This model is called infrastructure as a service (IaaS).

Amazon RDS: AWS takes the OS and engine

With Amazon RDS, the managed database you met in the moving plan, AWS also patches the operating system and database engine, and runs automated backups. You still manage the data, database users and permissions, which networks can connect, and whether to turn on encryption. Managed services like this are close to platform as a service (PaaS).

Sam: So no 2 a.m. database patching. I could hug someone.

Ranger: volunteers

AWS Lambda: you bring code and data

AWS Lambda runs your code without servers to manage. AWS handles the OS, the runtime, scaling and availability. The customer is responsible for the code, the data it touches, and the IAM permissions it runs with. At the far end, software as a service (SaaS) apps leave the customer mostly data and access to manage.

Exam tip Rule: the more managed the service, the more AWS does. But data, access and permissions stay with the customer every time.

Security OF the cloud

AWS is responsible for security of the cloud: the infrastructure that runs every service.

• Physical data centers: buildings, guards, power, cooling
• Hardware: servers, storage, network devices, and disposing of old disks safely
• The global network and the virtualization layer (hypervisor)
• The software of managed services (for example the database engine patching in Amazon RDS)
• Regions, Availability Zones and edge locations

Security IN the cloud

The customer is responsible for security in the cloud: their data, who can access it (IAM), how it's encrypted, network rules (security groups, network ACLs), and the guest operating system and apps on services where they control them (such as EC2).

Exam tip Physical security of a data center is always AWS. Customer data and IAM users are always the customer.

The more managed, the less you do

The split depends on how much of the stack AWS runs for you.

• Amazon EC2 (infrastructure): you patch the guest OS, install and update software, configure the firewall (security groups) and protect the data
• Amazon RDS (managed database): AWS patches the OS and database engine and runs backups; you manage database users, network access, encryption settings and your data
• AWS Lambda (serverless): AWS runs the servers, OS and runtime; you're responsible for your function code, its IAM permissions and your data
• Amazon S3: AWS runs the storage; you set bucket policies, encryption and who can access objects

Shared controls

Some controls are shared: patch management (AWS patches infrastructure, you patch your OS/apps), configuration management and awareness and training (each side trains its own people).

Exam tip Who patches the OS? EC2 = customer. RDS and Lambda = AWS.