2.1 The AWS Shared Responsibility Model

Quick Answer: AWS manages security OF the cloud (physical data centers, hardware, networking, hypervisor, and the infrastructure of managed services). You manage security IN the cloud (your data, IAM configuration, OS patches on EC2, encryption, and network/firewall rules). This is the #1 most tested concept on the CLF-C02 exam.

The Shared Responsibility Model is arguably the single most important concept on the CLF-C02 exam. AWS and the customer share security duties, and you must know exactly where the line falls for different service types.

The Core Concept

Think of it like renting an apartment. The landlord (AWS) is responsible for the building structure, roof, plumbing, electrical, and common areas. The tenant (you) is responsible for your furniture and belongings, locking the door, and not leaving the stove on. AWS secures the building; you secure what you put inside and how you use it.

AWS Responsibilities: Security OF the Cloud

Customer Responsibilities: Security IN the Cloud

How Responsibility Shifts by Service Type

The amount of customer responsibility depends on the service type — the more managed the service, the less you handle.

• IaaS (Amazon EC2): Customer manages the most — guest OS patches, application software, Security Groups, and data encryption. AWS manages the hypervisor and below.
• Managed services (Amazon RDS): Shared. AWS handles OS and database-engine patching and hardware; you handle database settings, Security Groups, IAM, data encryption, and backup configuration.
• Serverless (AWS Lambda) and fully managed (Amazon S3): AWS manages the most. Your duties shrink to your code/data, IAM permissions, and encryption configuration.

Always the Customer's Responsibility (Any Service)

1. Data classification and encryption — deciding what to protect and enabling encryption
2. IAM management — creating users, assigning least-privilege permissions, enabling MFA
3. Security Group / firewall configuration — controlling inbound and outbound traffic
4. Customer-specific compliance — meeting your regulatory obligations using AWS tools
5. Protecting data in transit and at rest — selecting and configuring encryption

Always AWS's Responsibility (Any Service)

1. Physical data-center security — guards, cameras, biometric access
2. Hardware maintenance — replacing failed drives, servers, and network gear
3. Network infrastructure — global backbone and infrastructure-level DDoS protection
4. Hypervisor and host OS — securing the virtualization platform
5. Environmental controls — power, cooling, and fire suppression

On the Exam: When you see a Shared Responsibility question, ask: "Is this about the physical infrastructure or about software configuration?" Physical = AWS. Configuration = Customer. And when in doubt, data and encryption are ALWAYS the customer's job, regardless of the service.

Worked Scenarios

Apply the model to a few common scenarios. A customer stores files in Amazon S3 but leaves a bucket world-readable and unencrypted: the exposure is the customer's fault, because data protection and access configuration are always the customer's job, even though AWS secures the underlying hardware. A failed physical disk in an AWS data center is replaced by AWS with no customer involvement. A missing security patch on a long-running EC2 instance is the customer's responsibility, while the same patch on the RDS engine is AWS's. Walking through "physical vs. configuration vs.

data" for each scenario is the fastest way to answer these questions correctly under time pressure.

Inherited, Shared, and Customer-Specific Controls

AWS describes three control categories that help clarify the split. Inherited controls are fully provided by AWS, such as physical and environmental data-center controls — the customer inherits them automatically. Shared controls apply to both layers; for example, patch management means AWS patches the infrastructure while the customer patches the guest OS and applications, and configuration management means AWS configures host devices while the customer configures their own guest operating systems, databases, and applications.

Customer-specific controls are entirely the customer's, such as classifying data and meeting industry-specific regulations using AWS tools. On the exam, "shared controls" like patching and configuration are common distractors — read carefully to see which layer the question is asking about.