100 Days of AWS – Day 7: The Shared Responsibility Model

Welcome to Day 7 of the challenge! After learning about AWS's global footprint, it's time to understand the security partnership that exists between AWS and you, the customer. This is defined by the Shared Responsibility Model.

The Question

Your company runs its main application on several EC2 instances using Amazon Linux 2. A new critical security vulnerability is discovered in the Linux operating system.

According to the AWS Shared Responsibility Model, who is responsible for applying the security patches to the operating systems on these EC2 instances?

The Correct Answer

The correct answer is (B) The customer is solely responsible.

Why It's Correct: Security OF the Cloud vs. IN the Cloud

The AWS Shared Responsibility Model is best summarized like this:

• AWS is responsible for the security OF the cloud. This includes the physical security of data centers, the hardware, the networking infrastructure, and the hypervisor that runs the EC2 instances. They secure the foundation.
• The Customer is responsible for security IN the cloud. This includes your data, your applications, identity and access management (IAM), and configuring your security groups. Crucially, for Infrastructure as a Service (IaaS) products like EC2, this includes managing and patching the guest operating system.

You choose the OS (Windows, Linux, etc.), you install your applications on it, and therefore, you are responsible for maintaining and securing it.

Analysis of the Incorrect Options

• (A) AWS is solely responsible: This is incorrect. While AWS secures the hardware the EC2 instance runs on, they do not manage the software or operating system you choose to run inside it.
• (C) Both AWS and the customer are equally responsible: This is misleading. While it's a "shared" model, the responsibilities are clearly divided, not ambiguously "equal." For this specific task (OS patching on EC2), the responsibility lies squarely with the customer.
• (D) A third-party security vendor: While a company might hire a third party to manage their security, the responsibility in the eyes of AWS still belongs to the customer. You can delegate the task, but you cannot delegate the responsibility.

How the Responsibility Shifts

It's important to know that this line of responsibility can shift depending on the service you use.

• IaaS (like EC2): You manage the OS, middleware, and application.
• PaaS (like Elastic Beanstalk): AWS manages the underlying OS and middleware for you. You only manage your application code.
• SaaS (like AWS Shield): AWS manages everything.

Keywords

• AWS Shared Responsibility Model
• Cloud Security
• AWS Security
• Customer Responsibility on AWS
• IAM (Identity and Access Management)
• Security of the cloud
• Security in the cloud
• OS Patching
• EC2 Security
• AWS Compliance
• Infrastructure as a Service (IaaS)
• Platform as a Service (PaaS)
• Data Encryption
• Network Controls
• "what is the shared responsibility model"
• "who is responsible for patching ec2 instances"
• "aws vs customer security responsibilities"
• "shared responsibility model for iaas vs paas"
• "aws cloud compliance"