Describing AWS responsibilities

Amazon Web Services (AWS) has defined a shared responsibility model that delineates the responsibilities of AWS and its customers to ensure a secure and compliant environment. This model is particularly relevant for individuals preparing for the AWS Certified Cloud Practitioner exam (CLF-C02), as it represents a critical component of the exam’s knowledge base.

1. AWS Responsibilities – Security of the Cloud

AWS is responsible for protecting the infrastructure that runs all the services offered in the AWS Cloud. This infrastructure comprises the hardware, software, networking, and facilities that run AWS Cloud services.

Key Aspects:

• Physical Security: AWS data centers are highly secure using state-of-the-art electronic surveillance and multi-factor access control systems. These data centers are staffed 24/7 by security guards and are designed to withstand various physical conditions and events.
• Infrastructure Maintenance: AWS is tasked with maintaining and updating the infrastructure, including the data centers’ physical equipment (like servers and networking gear) and the virtualized infrastructure.
• Software Security: AWS is in charge of the hypervisor (the virtualization layer), as well as the configuration of managed services like Amazon RDS and Amazon Redshift.
• Compliance Certification: AWS ensures that their data centers and services comply with a variety of standards and regulations such as ISO 27001, PCI DSS, HIPAA, and the General Data Protection Regulation (GDPR).

Example:

For Amazon EC2, AWS manages the physical security, hardware, and the host operating system, whereas the customer is responsible for the guest operating system, any application software, and the configuration of the AWS provided firewall (security groups).

2. Customer Responsibilities – Security in the Cloud

Customers are responsible for managing their data, including encryption options, the classification of their assets, and using IAM tools to apply the appropriate permissions.

Key Aspects:

• Data Protection: Customers should manage the data they put into AWS services, including classifying their assets, encrypting data as needed, and using AWS Identity and Access Management (IAM) to control access.
• Platform, Applications, Identity & Access Management: Users need to manage the guest operating system (including updates and security patches) and configure their AWS services in compliance with their specific security policies.
• Network and Firewall Configuration: Users also need to set up their own network access controls. This involves configuring security groups and network ACLs in Amazon VPC.
• Client-Side Data Encryption and Data Integrity Authentication: Customers are often responsible for encrypting data prior to transmitting it to AWS and for integrating client-side data integrity checks.
• Operating System, Network, and Firewall Configuration: On services like Amazon EC2, the customer is responsible for the management of the guest OS, including updates and security patches, as well as for firewall configuration.
• Customer Data: While AWS ensures the security of the infrastructure, how customers decide to protect their data within the AWS environment is up to them.

Example:

When you launch an instance using Amazon EC2, you need to ensure the secure configuration of the instance by setting up a strong password policy, implementing network ACLs and security groups, and rotating your credentials regularly.

3. AWS Shared Responsibility Model in Practice

In a comparison table format, the Shared Responsibility Model splits the tasks into two major sections:

4. Importance in an Exam Context

Understanding the AWS Shared Responsibility Model is essential for candidates preparing for the AWS Certified Cloud Practitioner exam. Questions may ask the test-taker to identify which security aspects fall under AWS’s umbrella and which are the user’s responsibility, or how certain compliance requirements are split between AWS and the customer.

When reviewing the shared responsibility model, you should remember that while AWS takes full control of the cloud infrastructure, customers maintain control over the security they choose to implement in the cloud to protect their own content, platform, applications, systems, and networks — just as they would in an on-premises data center.