⌂ Home

AWS Shared Responsibility Model

Know what AWS secures vs what you must secure for each service pattern.

Responsibility split

AWS operates the cloud; customers configure secure use of services in the cloud.

AWS (blue)

  • Physical security of data centers
  • Hypervisor and infrastructure patching (for managed areas)
  • Global backbone and edge locations

Customer (green)

  • Data classification & encryption choices
  • IAM, network rules, OS & app patching (where applicable)
  • Logging, monitoring, incident response runbooks

Service-specific examples

Select a service tab. Lines are illustrative—always read the current AWS documentation.

AWSCustomer
Host hardware, AZ resilienceGuest OS hardening, security groups, key pairs/IAM
EBS infrastructureEncryption selection, snapshot policies
AWSCustomer
Durability/availability of object storeBucket policies, ACLs/block public access, KMS keys
Managed encryption at rest optionsWho can decrypt; lifecycle & logging to trusted account
AWSCustomer
Managed DB engine maintenance windowsSubnet groups, parameter groups, master cred rotation strategy
Automated backups infrastructureAccess to snapshots; app-level encryption decisions
AWSCustomer
Runtime execution environmentFunction code, dependencies, env secrets, IAM role
Platform patchingVPC config, concurrency, dead-letter & observability

Benefits of the model

Clarity — scope pen tests and audits correctly.
Scale — inherit AWS physical and network controls.
Focus — invest engineering in app/data controls you own.