What is the AWS Shared Responsibility Model?
The AWS Shared responsibility model is a way for AWS to divide the duties of security, operations, and compliance with it's end users in the AWS cloud environment. Security and compliance of the logical and physical infrastructure is a shared responsibility between users and AWS within the AWS cloud. For the most part, AWS takes on the responsibility of managing the underlying hardware and facilites that host it's services. The AWS shared responsibility model allows users to focus on utilizing AWS services without having to manage the underlying hardware. Another way to describe the shared responsibility model is that AWS is responsible for security "of" the cloud, while the end user is responsible for security "in" the cloud. AWS is generally responsible for the compliance and security of the cloud itself. AWS users are generally responsible for the security and compliance of AWS resources that are utilized into the AWS cloud. This varies depending on services used and your industry guidelines. The level of customer responsibility can also dependent of the types services used (see What is an AWS fully managed service?). But in general, this is how AWS uses a "shared responsibility" model with it's users.
What is AWS responsible For?
AWS is responsibile for and guarantees the security and reliability of it's cloud and services. See What is an AWS Service Level Agreement? for more specific information regarding the guarantees that AWS provides. AWS consists of geographically distinct regions distributed throughout the world. Each region has it's own Availability Zones which are physically separated "data centers" within each region. The physical servers, storage, networks, and services contained in these Availability Zones are maintained by AWS. It is the responsibility of AWS to secure, patch, and update the physical infrastructure in each Availability Zone.
What are AWS Users Responsible For?
AWS users are responsible for the security and maintenance of what is deployed "within" the AWS cloud. Elastic Compute Cloud (EC2) is an example of a common service used within AWS. See What is an EC2 Instance? for more information about the EC2 Service. An EC2 instance is essentially a virtual machine that exists on AWS underlying hardware. Once an instance is created it is the obligation of the end user to patch and secure the Operating System and Applications on the instance. Additionally, the user is liable for configuring networking rules, encryption at rest, and encryption in transit.
