- Let's talk a little bit
about the shared responsibility model.
Now, this is nothing new.
This is something that vendors have had
in place for a long time.
And it represents a sort of agreement
between a provider and a customer.
And in the context of AWS,
it's gonna help us understand who takes responsibility
for the ownership of different parts
of the infrastructure, the services, the features,
and resources that are launched into the AWS ecosystem.
And so first let's talk a little bit
about the AWS side of it.
Now, Amazon Web Services are going to be responsible
for the security of the cloud itself.
So what does this mean?
This is going to be the underlying infrastructure
from data centers and physical locations
through the individual bits and pieces of hardware
that make up those data centers.
Servers, storage, network hardware and so forth.
They're gonna be responsible for the physical protection
of those data centers and making sure that access
is only granted when it is absolutely required.
AWS is going to be responsible
for all of the service API endpoints and securing those.
And they're responsible for the assurance
that when you issue a command or request a task
be performed through those service API endpoints,
that it is executed faithfully by the service.
The customer is not left out.
The customer also has a share of this responsibility.
And so from the customer perspective, you, me, us,
we are responsible for the security in the cloud
and there's a difference between security
of the cloud and security in the cloud.
The customer is going to be responsible for the security
of the individual resources that they provision
within their various AWS accounts.
And this includes a lot of different layers,
depending on the type of service that you're using.
If you are using an infrastructure service
like a VPC network or a virtual machine in EC2,
you as the customer are going to have a higher degree
of responsibility over securing that resource
than if you use something that is closer
to a SAS offering, software as a service
like an S3 bucket or a dynamo DB table.
Now, one thing to be clear is
that the customer always owns their data
and that the data is always private,
regardless of the service,
unless the customer explicitly shares it publicly.
Now, the next thing we need to talk about
within the shared responsibility model is ownership
of IT controls.
And so these are going to be tasks that need
to be regularly performed, audited, and assured
that they are being performed.
And so this is going to have a bit of a spectrum
as far as responsibility as well.
And so we start off here on the left with AWS
and AWS is going to be responsible
for certain actions like physically securing
the facilities that AWS data centers are operating in.
They're responsible for everything from air conditioning
to redundant power and so forth.
All of that underlying infrastructure that makes AWS work.
There's a middle ground where both AWS
and the customer share some of these controls.
And here's an excellent example.
AWS deploys actual servers into the data centers.
There is an AWS owned control to manage that hardware.
There is a shared control where AWS is responsible
for the patch management of the hypervisor
that runs on that hardware.
And then the customer is gonna share some of that
by being responsible for the patch management
of the virtual machines that actually run
on top of that hypervisor.
And so these shared controls are going to apply
to both the provider and the customer
but in different contexts.
And finally we have the customer controls,
and this is where the customer gets
to make explicit choices about where
and how to deploy their workloads,
where AWS makes these choices available.
But it is up to the customer to actually choose them based
on their own requirements, like which regions are going
to be used, or which services or features
are going to be opted into.
Now, this final diagram shows a little bit more
of the big picture around the specific tasks
that are split up between the customer and AWS.
And you can see here, we have listed customer
at the top where you own your data.
You own the OS network and firewall configuration.
You're responsible for configuration
of encryption of data and so forth.
And then on the bottom, we've got AWS responsible
for the security of the cloud itself
and we have the hardware here, different regions,
availability zones, service API endpoints,
as well as the underlying structure
that makes up the different services
for compute, network, storage, and database.