Shared Responsibility Model overview

Shared Responsibility Model

AWS splits security duties between itself and the customer. AWS is responsible for security of the cloud — the physical data centers, hardware, networking, and the managed services' underlying infrastructure. Customers are responsible for security in the cloud — how they configure what they run on top of that infrastructure.

For an EC2-based workload, that means AWS patches the host hypervisor and secures the building, while you patch the guest OS, manage security groups, and encrypt your data. For a fully managed service like Lambda or S3, AWS takes on more of the stack (OS patching, scaling), but you still own access policies, data classification, and client-side configuration.

The split shifts service by service — more abstracted services push more responsibility to AWS — but the customer is never fully hands-off. Knowing where the line falls for a given service is one of the most commonly tested concepts on the exam.