183. Shared Responsibility Model: Reminders and Examples

AWS responsibility

Security of the Cloud

Protecting infrastructure (hardware, software, facilities, and networking) that runs all the AWS services

AWS

Managed services like S3, DynamoDB, RDS, etc.

AWS

Customer responsibility

Security in the Cloud

For EC2 instance, customer is responsible for management of the guest OS (including security patches and updates), firewall & network configuration, IAM

You

Encrypting application data

You

Patch Management, Configuration Management, Awareness & Training

You and AWS

RDS

• Manage the underlying EC2 instance, disable SSH access

• Automated DB patching

• Automated OS patching

• Audit the underlying instance and disks & guarantee it functions

AWS

RDS

• Check the ports / IP / security group inbound rules in DB’s SG

• In-database user creation and permissions

• Creating a database with or without public access

• Ensure parameter groups or DB is configured to only allow SSL connections

• Database encryption setting

You

S3

• Guarantee you get unlimited storage

• Guarantee you get encryption

• Ensure separation of the data between different customers • Ensure AWS employees can’t access your data

AWS

S3

• Bucket configuration

• Bucket policy / public setting

• IAM user and roles

• Enabling encryption

You