What is the AWS Shared Responsibility Model?
Learn the AWS Shared Responsibility Model: how AWS secures the cloud while you secure your data, IAM, and configuration in the cloud.
Expected Interview Answer
The AWS Shared Responsibility Model divides security duties between AWS and the customer: AWS is responsible for security OF the cloud (the underlying hardware, network, and managed service infrastructure), while the customer is responsible for security IN the cloud (their data, configuration, access, and applications).
AWS secures the physical facilities, host operating systems, virtualization layer, and global infrastructure. The customer secures what they put on top: guest OS patching, IAM users and policies, security group rules, encryption of data at rest and in transit, and application code. The exact split shifts with the service model: with EC2 (IaaS) the customer patches the OS, while with managed services like S3, RDS, or Lambda AWS handles more of the stack, but the customer always owns their data and access control.
- Clarifies who secures what, avoiding gaps
- Lets customers focus effort on their data and access
- Adapts to IaaS, PaaS, and managed services
- Underpins compliance and audit boundaries
- Reduces the customer's infrastructure security burden
AI Mentor Explanation
A cricket board maintains the stadium, pitch and floodlights, guaranteeing a safe, regulation ground. But each team is responsible for its own players' fitness, strategy and discipline on that field. The Shared Responsibility Model splits duties the same way: AWS secures the stadium of infrastructure, while you secure your own team's data, access and conduct within it.
Step-by-Step Explanation
Step 1
Understand 'of' vs 'in'
AWS secures the cloud (infrastructure); the customer secures what they run in the cloud (data and config).
Step 2
Map AWS responsibilities
Physical facilities, hardware, network, virtualization, and managed-service infrastructure are AWS's job.
Step 3
Map customer responsibilities
Data, IAM, guest OS patching (for IaaS), security groups, and encryption are the customer's job.
Step 4
Adjust for the service model
IaaS pushes more onto the customer; managed and serverless services shift more to AWS, but data and access always stay with the customer.
Step 5
Apply security controls
Implement least-privilege IAM, encryption, patching, and network rules for the parts you own.
Step 6
Verify with audits
Use AWS compliance reports for AWS's side and tools like Config and Security Hub for your side.
What Interviewer Expects
- Distinguishes security OF the cloud vs IN the cloud
- Knows AWS owns physical and infrastructure security
- Knows customer owns data, IAM, and configuration
- Understands the split varies by IaaS vs managed services
- Recognizes data and access are always the customer's duty
Common Mistakes
- Assuming AWS secures everything, including your data
- Believing managed services remove all customer responsibility
- Forgetting guest OS patching is the customer's job on EC2
- Leaving S3 buckets or security groups misconfigured and blaming AWS
- Not encrypting data or applying least-privilege IAM
Best Answer (HR Friendly)
“The AWS Shared Responsibility Model means security is a partnership: AWS protects the underlying data centers and hardware, while the customer protects their own data, user access, and settings. In short, AWS secures the cloud, and you secure what you put in it.”
Code Example
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadWriteAppBucketOnly",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-app-data/*"
},
{
"Sid": "DenyUnencryptedUploads",
"Effect": "Deny",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-app-data/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
}
]
}Follow-up Questions
- Who is responsible for patching the guest OS on an EC2 instance?
- How does the model differ for S3 or Lambda versus EC2?
- What customer responsibilities apply to data encryption?
- Which AWS tools help audit your side of the model?
- Why is IAM configuration always the customer's responsibility?
MCQ Practice
1. Under the model, who secures the physical data center hardware?
AWS is responsible for security OF the cloud, which includes physical facilities and hardware.
2. On an EC2 instance, who is responsible for patching the guest operating system?
For IaaS like EC2, the customer patches and secures the guest OS and everything above it.
3. Which responsibility always stays with the customer regardless of service?
Customers always own their data classification, IAM, and access controls even in fully managed services.
Flash Cards
What is the AWS Shared Responsibility Model? — A division where AWS secures the cloud (infrastructure) and the customer secures what they put in the cloud (data, access, config).
Security OF vs IN the cloud? — OF the cloud = AWS's infrastructure duty; IN the cloud = the customer's data and configuration duty.
Who patches the guest OS on EC2? — The customer, because EC2 is IaaS and the OS sits in the customer's layer.
What is always the customer's responsibility? — Their data, IAM/access management, and configuration, no matter which service is used.