Shared Responsibility Model

Learning Path

📘 Phase 1 – Overview

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand the AWS Shared Responsibility Model.
Differentiate between AWS responsibilities and customer responsibilities.
Explain how responsibilities change across different AWS service models.
Identify common security misconceptions.
Apply the Shared Responsibility Model to real-world enterprise scenarios.

📚 Lesson Information

Estimated Time: 90 Minutes

Difficulty: Beginner

Prerequisites: Cloud Security Fundamentals

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

One of the most common causes of cloud security incidents is misunderstanding who is responsible for securing cloud resources.

Many organisations assume that because they use AWS, AWS secures everything.

This assumption is incorrect.

AWS secures the cloud infrastructure, while customers are responsible for securing their workloads, identities, applications, and data.

Understanding this shared responsibility is essential for designing secure cloud environments.

🌍 What is the Shared Responsibility Model?

Cloud security is a partnership between AWS and the customer.

AWS is responsible for the Security OF the Cloud.

Customers are responsible for Security IN the Cloud.

                AWS Cloud

+--------------------------------------+
|                                      |
|  Security OF the Cloud               |
|                                      |
|  ✔ Data Centres                      |
|  ✔ Physical Security                 |
|  ✔ Networking Hardware               |
|  ✔ Hypervisor                        |
|  ✔ Global Infrastructure             |
|                                      |
+--------------------------------------+

                Customer

+--------------------------------------+
|                                      |
|  Security IN the Cloud               |
|                                      |
|  ✔ IAM                               |
|  ✔ Applications                      |
|  ✔ Operating Systems                 |
|  ✔ Data                              |
|  ✔ Encryption                        |
|  ✔ Network Configuration             |
|  ✔ Logging                           |
|                                      |
+--------------------------------------+

🔐 Security OF the Cloud

AWS manages the underlying infrastructure that supports cloud services.

AWS responsibilities include:

Physical data centres
Buildings
Power supply
Cooling systems
Networking hardware
Storage hardware
Physical servers
Hypervisors
Global infrastructure
Hardware maintenance

Customers never manage these components.

👨‍💻 Security IN the Cloud

Customers are responsible for everything they deploy.

Examples include:

IAM users
Roles
Policies
Password policies
Multi-Factor Authentication
EC2 operating systems
Installed software
Security Groups
Network ACLs
Customer data
Encryption keys
Application code
API security
Logging configuration
Backups

These responsibilities remain with the customer regardless of organisation size.

🔄 Responsibilities Change by Service

The level of customer responsibility depends on the AWS service being used.

Amazon EC2 (Infrastructure as a Service)

AWS manages:

Physical servers
Networking
Storage hardware
Hypervisor

Customer manages:

Operating System
Firewall rules
Security Groups
Installed software
Applications
IAM
Data
Backups
Monitoring

Amazon RDS (Managed Database)

AWS additionally manages:

Database software
Operating system patching
Infrastructure maintenance

Customer still manages:

Database users
Database permissions
Encryption
Backups
Network access
Database configuration

Amazon S3

AWS manages:

Storage infrastructure
Hardware
Availability

Customer manages:

Bucket policies
Public access settings
Object permissions
Encryption
Versioning
Lifecycle policies

AWS Lambda

AWS manages:

Infrastructure
Runtime environment
Scaling
Operating system

Customer manages:

Function code
IAM roles
Secrets
Environment variables
Logging
Permissions

📊 Responsibility Comparison

Component	AWS	Customer
Physical Data Centre	✅	❌
Networking Hardware	✅	❌
Hypervisor	✅	❌
Operating System (EC2)	❌	✅
IAM Users	❌	✅
IAM Policies	❌	✅
Customer Data	❌	✅
Application Code	❌	✅
Security Groups	❌	✅
Encryption Keys	❌	✅
CloudTrail Configuration	❌	✅

🚨 Common Misconceptions

❌ “AWS automatically secures my EC2 instance.”

Reality:

AWS secures the infrastructure.

You secure the operating system, applications, users, and data.

❌ “AWS creates backups automatically.”

Reality:

Backup configuration is your responsibility unless you explicitly enable managed backup services.

❌ “AWS protects my IAM users.”

Reality:

You must:

Enable MFA
Rotate credentials
Remove unused accounts
Apply least privilege

❌ “My S3 bucket can’t become public.”

Reality:

Incorrect bucket policies or ACLs can expose sensitive information to the internet.

🏢 Enterprise Scenario

CloudNova Technologies

The development team launches a customer application on Amazon EC2.

Six months later:

Operating system updates have not been installed.
Administrator passwords have never been rotated.
Security Groups allow access from 0.0.0.0/0.
CloudTrail has not been enabled.
Customer files are stored unencrypted.

Management asks:

“Why didn’t AWS prevent this?”

As the Cloud Security Engineer:

Explain the Shared Responsibility Model.
Identify which issues belong to AWS.
Identify which issues belong to CloudNova Technologies.
Recommend remediation actions.

🧪 Hands-on Exercise 1 — Explore AWS Documentation

Visit:

https://aws.amazon.com/compliance/shared-responsibility-model/

Read the AWS Shared Responsibility Model.

Create a table with:

AWS Responsibility	Customer Responsibility
Physical Security	IAM
Hypervisor	Operating Systems
Networking Hardware	Applications
Data Centres	Customer Data

🧪 Hands-on Exercise 2 — Secure an AWS Account

Verify:

MFA enabled
Billing alerts configured
Root account protected
No unused access keys
Contact information updated

Document your findings.

🧪 Hands-on Exercise 3 — Review IAM Responsibilities

Open:

AWS Console → IAM

Review:

Users
Groups
Roles
Policies

Questions:

Which IAM resources did AWS create?
Which IAM resources did you create?
Who is responsible for securing them?

🧪 Hands-on Exercise 4 — Analyse AWS Services

Complete the following table.

AWS Service	AWS Responsibility	Customer Responsibility
EC2	Infrastructure	OS, Applications, IAM
RDS	Database Platform	Users, Data
S3	Storage Platform	Bucket Policies
Lambda	Runtime	Code, IAM
DynamoDB	Infrastructure	Data, Access Policies

Discuss how customer responsibility changes as services become more managed.

🧪 Hands-on Exercise 5 — Security Review

Review the following fictional environment.

Public EC2 instance
Public S3 bucket
IAM AdministratorAccess assigned to every user
No CloudTrail
No encryption
No backups

For each issue, identify:

Is AWS responsible?
Is the customer responsible?
How would you remediate it?

📊 Knowledge Check

Answer the following questions:

What is the Shared Responsibility Model?
What is the difference between Security OF the Cloud and Security IN the Cloud?
Who manages the physical data centres?
Who secures EC2 operating systems?
Who configures IAM policies?
Who secures customer data?
How do responsibilities change when using managed services?

📝 Assignment

Prepare a Shared Responsibility Assessment Report for CloudNova Technologies.

Include:

Explanation of the Shared Responsibility Model.
AWS responsibilities.
Customer responsibilities.
Responsibilities for EC2, S3, RDS, and Lambda.
Five common misconceptions.
Recommendations to improve security posture.

Length: 2–3 pages.

💡 Key Takeaways

After completing this lesson, you should understand:

Cloud security is a shared responsibility.
AWS secures the infrastructure.
Customers secure identities, workloads, applications, and data.
Customer responsibilities vary depending on the AWS service.
Understanding ownership helps prevent security gaps and compliance failures.

📚 Further Reading

AWS Shared Responsibility Model
AWS Well-Architected Framework – Security Pillar
AWS IAM Best Practices
CIS AWS Foundations Benchmark
AWS Security Best Practices

🚀 Next Lesson

➡️ CIA Triad