AWS Shared Responsibility Model

Now that you are ready to begin your journey, the first step is to understand who is responsible for what when it comes to cloud computing. Security for both workloads and data stored in the cloud is separated into functions performed by both the customer and the cloud service provider (in this case Amazon Web Services). The shared responsibility model describes which duty belongs to whom.

From its very name the shared responsibility model, it is clear from the outset that more than one party is involved. This model defines where the customer’s responsibility for implementing, controlling, and managing security within AWS starts and ends, compared to that of the cloud service provider, in this case, AWS.

The roles and responsibilities of managing security require a shared awareness between the two parties. The model itself is not a legal agreement in any way; it is simply down to you to be aware of the model and understand its importance...

Technical Requirements

There is a requirement to have a basic understanding of AWS services and IaaS, PaaS, and SaaS cloud service models. Having a good understanding of Infrastructure as a Service (IaaS), Platform as a Service (Paas), and Software as a Service (SaaS) will come into play as you learn about the nuances of the different models and how the responsibilities shift between cloud provider (AWS in this case) and you the customer.

You’ll begin this chapter with a breakdown of which sections of security you, the customer, and AWS, the cloud provider are individually responsible for, depending on the type of service you are using on the platform.

AWS Shared Responsibility Models

The more customizable your service or platform, the more responsibilities you hold as the customer.

The AWS service that you choose to use dictates your responsibility based on the amount of configuration that needs to be performed in the service tier.

Figure 1.1: A Comparison of Shared Responsibility Models

Figure 1.1 shows that infrastructure services, which are presented as an IaaS platform, including services such as EC2, hold many more customer responsibilities regarding security. The trade-off you receive for this more significant burden of responsibility is the flexibility and customization you are allowed in the layer. You can see that each of the different models is labelled directly underneath, and each of the models will be discussed in detail in the following pages.

The basis for what AWS is responsible for remains the same—that is, the Hardware and AWS Global Infrastructure, and the AWS Foundational...

Auditors and the Shared Responsibility Model

Many industries require you to show compliance in your cloud environment as it relates to industrial controls.

Using and understanding the shared security model will help you and your auditors understand which controls you, as the customer, are responsible for and which ones are the responsibility of AWS, the cloud provider.

Suppose your auditor is requesting information or evidence for something that AWS manages. In that case, you can refer the auditor to the specific shared responsibility model for the service to show how the cloud service provider maintains control of that particular standard.

Summary

This chapter discussed the three shared security models used for AWS services: infrastructure, container, and abstract services. You learned that, from a security perspective and depending on the service you are using, your responsibility as a customer and that of AWS as the cloud provider can change from a responsibility perspective.

Understanding these models and being able to differentiate between them will be beneficial when you implement your security strategies across your solutions as it means you will clearly understand where your responsibility ends and AWS’s responsibility begins. This will help ensure that you do not leave any vulnerabilities across your AWS infrastructure within your accounts.

You also examined how the shared security model can help you by clarifying which items you and your organization are responsible for when it comes to compliance and audits for your business.

The next chapter, will provide a brief overview of many of the services...

Further Reading

For additional information on the AWS shared responsibility model and an underlying foundation to AWS security, please refer to the following resources:

• Introduction to AWS Security: https://d1.awsstatic.com/whitepapers/Security/Intro_to_AWS_Security.pdf
• The shared responsibility model: https://aws.amazon.com/compliance/shared-responsibility-model/

Further Reading

For additional information on the AWS shared responsibility model and the underlying foundation of AWS security, please refer to the following resources:

• Introduction to AWS Security: https://packt.link/yoltd
• The shared responsibility model: https://packt.link/JjZ65

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH01.

   Alternatively, you can scan the following QR code (Figure 1.6):

Figure 1.6: QR code that opens Chapter Review Questions...