Lesson 03 — AWS Shared Responsibility Model

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 01 – AWS Security Foundations

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Explain the AWS Shared Responsibility Model.
Differentiate between Security of the Cloud and Security in the Cloud.
Identify customer and AWS responsibilities for different AWS services.
Apply the Shared Responsibility Model to real enterprise scenarios.
Avoid common cloud security misconceptions.

📚 Lesson Information

Estimated Time: 2 Hours

Difficulty: Beginner

Prerequisites: Lesson 01 & Lesson 02

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

One of the biggest misconceptions in cloud computing is:

“Since everything is hosted on AWS, AWS secures everything.”

This is incorrect.

While AWS secures the underlying cloud infrastructure, customers remain responsible for securing their applications, data, identities, operating systems and configurations.

Understanding these responsibilities helps organisations:

Reduce security risks
Prevent data breaches
Meet compliance requirements
Build secure cloud architectures
Clearly define operational responsibilities

🌍 What is the AWS Shared Responsibility Model?

The Shared Responsibility Model defines the division of security responsibilities between AWS and its customers.

AWS manages the security of the cloud.

Customers manage security in the cloud.

Both parties work together to achieve a secure cloud environment.

☁️ Shared Responsibility Model

                 AWS Shared Responsibility Model

                +-------------------------------+
                |      Customer Responsibility  |
                |-------------------------------|
                | Data                          |
                | Identity & Access             |
                | Applications                  |
                | Operating System              |
                | Network Configuration         |
                | Encryption                    |
                | Security Groups               |
                | Monitoring                    |
                +-------------------------------+

                Security IN the Cloud
────────────────────────────────────────────────────

                Security OF the Cloud

                +-------------------------------+
                | AWS Responsibility            |
                |-------------------------------|
                | Physical Data Centres         |
                | Hardware                      |
                | Storage Infrastructure        |
                | Networking Infrastructure     |
                | Hypervisor                    |
                | Global Infrastructure         |
                +-------------------------------+

🔒 Security OF the Cloud

AWS is responsible for protecting the infrastructure that runs AWS services.

Examples include:

Physical security
Data centre operations
HVAC systems
Physical networking
Fibre infrastructure
Global backbone
Servers
Storage hardware
Hypervisors
Availability Zones
Regions

Customers never manage these components.

🔐 Security IN the Cloud

Customers are responsible for securing everything they deploy within AWS.

Typical responsibilities include:

IAM Users
IAM Roles
IAM Policies
MFA
Operating System patches
Application security
Data encryption
Security Groups
Network ACLs
Secrets
Logging
Monitoring
Backup configuration

🏢 Enterprise Example

CloudNova launches a new web application on Amazon EC2.

Question:

Who is responsible for securing each layer?

Component	Responsibility
Physical Server	AWS
Data Centre	AWS
Hypervisor	AWS
EC2 Operating System	Customer
Installed Software	Customer
Application Code	Customer
Database Credentials	Customer
IAM Policies	Customer
Security Groups	Customer

📊 Shared Responsibility by AWS Service

Amazon EC2

AWS	Customer
Physical Infrastructure	Guest Operating System
Hypervisor	Patching
Hardware	Firewall Rules
Availability	Applications
Networking Infrastructure	IAM
Power & Cooling	Encryption

Amazon S3

AWS manages:

Storage infrastructure
Hardware
Availability

Customer manages:

Bucket Policies
IAM
Encryption
Public Access
Object Permissions
Lifecycle Policies

Amazon RDS

AWS manages:

Database platform
Hardware
Operating system
Database engine patching

Customer manages:

Database users
Passwords
Security Groups
Encryption
Database configuration
Backup strategy

AWS Lambda

AWS manages:

Runtime
Infrastructure
Scaling
Availability

Customer manages:

Function code
IAM execution role
Secrets
Environment variables
Logging
Third-party libraries

Amazon EKS

AWS manages:

Control Plane

Customer manages:

Worker Nodes
Kubernetes configuration
RBAC
Pods
Containers
Secrets
Network Policies

❌ Common Misconceptions

AWS patches my EC2 operating system.

❌ False

Customers are responsible for patching EC2 instances.

AWS secures my S3 bucket.

❌ False

AWS secures the storage platform.

Customers secure bucket access.

AWS creates IAM users.

❌ False

Customers create and manage IAM identities.

AWS encrypts everything automatically.

❌ False

Customers choose encryption options and manage encryption keys where applicable.

🏢 CloudNova Enterprise Scenario

CloudNova recently migrated its HR application to AWS.

During a security review, the following issues were identified:

EC2 instances have not been patched for six months.
An S3 bucket is publicly accessible.
IAM users do not have MFA enabled.
Security Groups allow unrestricted SSH access.
Database passwords are weak.

The CIO asks:

“AWS is a secure cloud provider. Why do we still have these issues?”

As the Cloud Security Engineer, explain which issues are AWS’s responsibility and which belong to CloudNova.

🧪 Enterprise Mission 01 — Review AWS Account Identity

Objective

Identify which AWS account you are currently working in.

Step 1 — Open PowerShell

Verify the AWS CLI:

aws --version

Step 2 — Display Current Identity

aws sts get-caller-identity

Example output:

{
  "UserId": "AIDAXXXXXXXXXXXXX",
  "Account": "123456789012",
  "Arn": "arn:aws:iam::123456789012:user/student"
}

Record:

Account ID
IAM User
ARN

🧪 Enterprise Mission 02 — Review IAM Account Summary

Run:

aws iam get-account-summary

Observe:

Number of Users
Groups
Roles
MFA Devices
Account Settings

Questions:

How many IAM users exist?
Is MFA configured?
How many roles are available?

🧪 Enterprise Mission 03 — Inspect AWS Resources

List S3 Buckets:

aws s3api list-buckets

List EC2 Instances:

aws ec2 describe-instances

List Lambda Functions:

aws lambda list-functions

List RDS Databases:

aws rds describe-db-instances

Think about:

Who is responsible for securing each resource?

🧪 Enterprise Mission 04 — Shared Responsibility Exercise

Complete the table.

Task	AWS	Customer
Physical Security	✅
Patch EC2 Operating System		✅
Configure IAM		✅
Replace Failed Hardware	✅
Configure Security Groups		✅
Encrypt S3 Data		✅
Secure Hypervisor	✅
Create Backups		✅
Configure MFA		✅
Manage Application Code		✅

🧪 Enterprise Mission 05 — AWS Documentation Review

Visit:

https://aws.amazon.com/compliance/shared-responsibility-model/

Read the AWS Shared Responsibility documentation.

Identify:

Three AWS responsibilities.
Three customer responsibilities.
One example where responsibility changes depending on the AWS service.

💡 Security Tip

Managed services reduce operational effort but do not eliminate customer security responsibilities.

For example:

AWS patches the underlying RDS operating system.
You are still responsible for:
- Database users
- Passwords
- Encryption
- Security Groups
- Database backups
- Data classification

📊 Knowledge Check

What is the Shared Responsibility Model?
What is Security of the Cloud?
What is Security in the Cloud?
Who patches EC2 operating systems?
Who manages IAM users?
Who secures AWS data centres?
Who secures S3 bucket permissions?
Who configures Security Groups?
Does AWS manage your application code?
Why is the Shared Responsibility Model important?

📝 Assignment

Prepare a Shared Responsibility Assessment Report for CloudNova Technologies.

Include:

Explanation of the Shared Responsibility Model.
Security of the Cloud vs Security in the Cloud.
Responsibilities for:
- EC2
- S3
- RDS
- Lambda
- EKS
Common misconceptions.
Recommendations for improving CloudNova’s cloud security posture.

Length: 2–3 pages.

💡 Key Takeaways

After completing this lesson, you should understand:

AWS and customers share responsibility for cloud security.
AWS secures the infrastructure that runs cloud services.
Customers secure everything they deploy and configure within AWS.
The level of customer responsibility changes depending on the AWS service model.
Understanding this model is essential for designing secure cloud environments and avoiding security gaps.

📚 Further Reading

AWS Shared Responsibility Model Documentation
AWS Well-Architected Framework – Security Pillar
AWS Security Best Practices
AWS IAM User Guide
AWS Security Blog

🚀 Next Lesson

➡️ Lesson 04 — AWS Security Best Practices