AWS Shared Responsibility Model
AWS responsibility - Security of the Cloud
Protecting infrastructure (hardware, software, facilities, and networking) that runs all the AWS services
Managed services like S3, DynamoDB, RDS, etc.
Customer responsibility - Security in the Cloud
For the EC2 instance, the customer is responsible for the management of the guest OS (including security patches and updates), firewall & network configuration, IAM
Encrypting application data
Shared controls:
• Patch Management, Configuration Management, Awareness & Training
RDS
• AWS responsibility:
Manage the underlying EC2 instance, disable SSH access
Automated DB patching
Automated OS patching
Audit the underlying instance and disks & guarantee it functions
• Your responsibility:
Check the ports / IP / security group inbound rules in DB’s SG
In-database user creation and permissions
Creating a database with or without public access
Ensure parameter groups or DB is configured to only allow SSL connections
Database encryption setting
S3
• AWS responsibility:
Guarantee you get unlimited storage
Guarantee you get encryption
Ensure separation of the data between different customers
Ensure AWS employees can’t access your data
• Your responsibility:
Bucket configuration
Bucket policy / public setting
IAM user and roles
Enabling encryption
Shared Responsibility Model diagram
Last updated
