AWS Shared Responsibility Model

AWS responsibility - Security of the Cloud
- Protecting infrastructure (hardware, software, facilities and networking) that runs all of the AWS services
- Managed services like S3, DynamoDB, RDS etc
Customer responsibility - Security in the Cloud
- For EC2 instance, customer is responsible for management of the guest OS (including security patches), firewall and network configuration, IAM etc.

Example for RDS:

AWS responsibility:
- Manage the underlying EC2 instance, disable SSH access
- Automate DB patching
- Automate OS patching
- Audit the underlying instance and disk. Guarantee it function
Customer responsibility:
- Check the ports/IP/SG inbound rules in DB's SG
- In-database user creation and permissions
- Creating a database with or without public access
- Ensure parameter groups or DB is configured to only allow SSL connections
- Database encryption settings

AWS responsibility:
- Guarantee we get unlimited storage
- Guarantee we get encryption
- Ensure separation of the data between different customers
- Ensure AWS employees can't access customer's data
Customer responsibility:
- Bucket configuration
- Bucket policy / public settings
- IAM user and roles
- Enable encryption