What does the AWS shared responsibility model mean in practice for EC2, RDS and S3?
AWS is responsible for security of the cloud: facilities, hardware and the managed service layers. You are responsible for security in the cloud: your data, access control, and configuration. The more managed the service, the more AWS handles.
Explain it simply
Renting a flat: the landlord looks after the building, the lifts and the main gate. You are responsible for locking your own door, who you give the key to, and what you keep inside. The model works the same on AWS.
Example
EC2 (you manage more)
AWS : data centres, hardware, hypervisor
You : guest OS patching, security groups, application, data, IAM
RDS (managed)
AWS : hardware, OS patching, database software patching, backups tooling
You : who can connect (security groups, IAM), DB users and passwords,
encryption choices, data, parameter settings
S3 (fully managed)
AWS : storage infrastructure and durability
You : bucket policies, public access settings, encryption, versioning,
what data you put thereMost real-world cloud breaches come from the customer side: a public S3 bucket, an open security group on port 22, or leaked access keys.
Remember the short form: AWS secures the cloud itself, you secure what you put in it and how you configure it.
What to say in the interview
"AWS handles security of the cloud: facilities, hardware and the managed layers. I handle security in the cloud: data, IAM, network rules, encryption settings and, on EC2, OS patching. The more managed the service is, the less I patch, but I always own access and data."
Common mistakes
- Assuming AWS patches the guest operating system on EC2.