The Shared Responsibility Model
A news story says a company "was hacked on AWS": a storage bucket full of customer records was left open to the world. Was that AWS's failure? No. AWS stored the files exactly as instructed; the company told it to share them with everyone. Before Inkwell grants anyone access to anything, it needs to know which half of security is its own.
The rule
AWS secures the cloud; you secure what you put in it.
Security is split along a clear line:
- Security of the cloud — AWS. The buildings, guards, power, physical servers, disks, network cables, and the virtualisation layer that keeps customers apart. Also the software behind managed services.
- Security in the cloud — you. Your data, who can access it (IAM), how your network is configured (security groups, routes), whether data is encrypted, and anything you install and run yourself.
The line moves with the service model:
- EC2 (IaaS): you own the guest operating system. Patching Linux, configuring the firewall and hardening the software are yours.
- Amazon RDS (a managed database): AWS patches the database engine and its operating system. You still manage database users, network access and backups policy.
- S3 (a fully managed service): AWS runs everything underneath. You still decide who can read each bucket and whether objects are encrypted.
Some things never move: your data, your identities and your access settings are always yours.
The shortcut
Ask "Can I configure it?" If there is a setting you can change, securing that setting is your responsibility. If you cannot even see it, such as a physical disk, it is AWS's.
Linux patches on the web server
Inkwell chose the image and can log in to the OS. Configurable, so Inkwell's job.
The trap is assuming "managed" means "nothing for me to do". Even on the most managed service, a wrong access setting exposes your data, and that setting is always yours.
Drills
Answer fast — trust the rule.
Who patches the operating system on an EC2 instance?
Who is responsible for the physical security of AWS data centres?
Inkwell's S3 bucket was made public by mistake. Whose responsibility was that setting?
Moving from EC2 to a managed service like RDS changes what?
Remember
- AWS secures the cloud; you secure what you put in it.
- Shortcut: if you can configure it, you must secure it.
- Trap: "managed" never means your data and access settings are handled for you.