Amazon Web Services states the shared-responsibility model in public. AWS is responsible for security of the cloud: the hardware, software, networking, and facilities that run AWS services. The customer is responsible for security in the cloud. AWS says that responsibility depends on which services you pick. For Amazon EC2, AWS says the customer manages the guest operating system, including updates and security patches, the application software the customer installs, and the security-group firewall on the instance.
The split
Read this before a repatriation argument or a board slide that says “AWS is certified, so we are covered.” A certification of the provider’s infrastructure is not a patch on your image, a backup of your bucket, or a rule on your security group. AWS also says customers should look at the services they chose, because the work changes with the service, and because laws and regulations still apply to the customer.
The lines
| Question | Write the owner |
|---|---|
| Who patches the guest OS on each EC2 image? | A person’s name, not “AWS” |
| Who sets the security group? | The team that can open a port |
| Who backs up data in a managed store, and who has tested a restore? | Still you, unless a contract names the provider’s backup product and you have a restore date |
| Who configures encryption and keys? | The person who can lose the key |
| Which of these would move if you left for a colo? | The guest, the app, the data, the firewall rules. The building would not. |
FAQ
Does this page cover Azure or Google Cloud?
The wording here is AWS’s, because that is the page linked below. Other providers publish their own split. Do not paste the AWS sentence onto another logo. Open that provider’s page and redo the table.
Is the provider responsible for nothing in the guest?
AWS’s page draws the line at the host and the facility for EC2, and at the customer for the guest and the security group. Managed services move some of the platform work. They do not move your data-retention choices. Read the service you actually bought.