2.1
Shared Responsibility Model
AWS secures the cloud; customers secure what they put in the cloud — responsibilities shift by service model.
Key points
- AWS: physical data centers, hardware, foundational networking.
- Customer: data, IAM, passwords, app config, encryption choices, OS patches on EC2.
- Lambda shifts more infrastructure burden to AWS than EC2.
Shared Responsibility Model
The Shared Responsibility Model is one of the most important CLF-C02 topics.
AWS: Security OF the cloud
Customer: Security IN the cloud
AWS responsibilities
- Physical data centers
- Physical servers
- Networking infrastructure
- Hardware
- Foundational infrastructure
Customer responsibilities
- Data
- IAM permissions
- Passwords
- Application configuration
- Encryption choices
- Operating system patches where applicable
- Security configuration
Important
Responsibilities vary depending on the AWS service being used.
Example: EC2
With EC2, customers are responsible for managing the operating system, applications, and instance configuration.
Example: Lambda
With Lambda, AWS manages the underlying infrastructure while the customer primarily manages function code and configuration.
Exam focus
EC2 vs Lambda responsibility split appears frequently.