3.1. AWS Shared Responsibility Model
💡 First Principle: At its core, the AWS Shared Responsibility Model clarifies security obligations in the cloud. Think of it like renting an apartment: the landlord (AWS) secures the building structure, locks, and common areas, while you (the tenant) secure your belongings, lock your door, and control who gets your spare key. Without understanding this division, organizations either assume AWS handles everything (leaving critical gaps in application security) or waste resources duplicating protections that AWS already provides — both scenarios lead to security failures.
AWS is responsible for "security of the cloud", encompassing the underlying infrastructure. Conversely, the customer is responsible for "security in the cloud", covering everything configured and managed within their AWS environment.
Scenario: A company is considering moving its applications to AWS and is trying to understand who is responsible for which security aspects. They are unsure about the physical security of data centers versus the security of their application code.
Reflection Question: How does the AWS Shared Responsibility Model fundamentally clarify security obligations in the cloud — and what breaks when an organization misunderstands which side of the model their responsibility falls on?
