CLF-C02
Deep Dive
The shared responsibility model defines what AWS manages and what the customer manages. It's one of the most heavily tested concepts on the CLF-C02 — it shows up across many scenarios where you must decide who is responsible for what.
Contents
🏢 AWS — Security OF the cloud
AWS is responsible for the security of the infrastructure that runs every service in the AWS Cloud. This includes:
👤 Customer — Security IN the cloud
The customer is responsible for the security of everything they put IN the cloud. This includes:
Key phrase for the exam
"Security OF the cloud"
= AWS's responsibility
The infrastructure that RUNS the services
"Security IN the cloud"
= The customer's responsibility
What the customer puts INSIDE the cloud
In IaaS, the customer has the highest level of control and responsibility. EC2 is the main example.
| Layer | AWS (Security OF) | Customer (Security IN) |
|---|---|---|
| Physical hardware | ✓ Servers, CPUs, physical disks | ✗ No access to hardware |
| Hypervisor / virtualization | ✓ AWS hypervisor, VM isolation | ✗ No hypervisor access |
| Physical network | ✓ Switches, routers, cabling | ✗ Does not manage physical network |
| Operating system | ✗ Only provides the base AMIs | ✓ Patches, updates, antivirus, OS hardening |
| Applications | ✗ Has no visibility into what apps the customer installs | ✓ Install, configure, patch applications |
| Data | ✗ Does not access customer data | ✓ Encryption, backup, retention, classification |
| Access and identity | ✗ Does not manage customer users | ✓ IAM, users, roles, policies, MFA |
| Security Groups / NACLs | ✗ Not configured by default | ✓ Define network firewall rules |
In PaaS, AWS manages more layers. The customer gives up control of the OS and middleware, but remains responsible for data and IAM.
AWS manages (RDS as an example)
Customer manages (RDS as an example)
In SaaS services like Amazon S3, AWS manages virtually all of the infrastructure. The customer only needs to worry about the data and the access permissions.
AWS manages (S3)
Customer manages (S3)
Amazon EC2
IaaSAWS manages
Hypervisor, physical hardware, physical network, facilities
Customer manages
OS (patches), applications, data, Security Groups, IAM, encryption
Exam trap
If your EC2 instance is hacked through an unpatched OS vulnerability: that's the CUSTOMER's responsibility. If the physical datacenter floods: that's AWS.
Amazon RDS
PaaS (managed)AWS manages
Hardware, OS, database engine (patches), Multi-AZ, automated backups
Customer manages
Data in the DB, DB users, Security Groups, enabling encryption at rest
Exam trap
AWS patches the RDS engine automatically. You do NOT manage the OS of the RDS server.
Amazon S3
SaaS (fully managed)AWS manages
Storage hardware, replication across multiple AZs, S3 infrastructure
Customer manages
Bucket policies, ACLs, uploaded data, encryption, public access (turn it off)
Exam trap
If you leave an S3 bucket public and sensitive data is exposed: that's the CUSTOMER's responsibility (misconfiguration).
AWS Lambda
Serverless (fully managed)AWS manages
Function servers, OS, runtime (Node.js, Python), automatic scaling
Customer manages
Function code, environment variables, assigned IAM roles, data processed
Exam trap
Lambda: AWS manages the server, but YOU are responsible for the code. A vulnerability in your code = the customer's responsibility.
❓ Who is responsible for encrypting data in S3?
The CUSTOMER enables encryption and defines the access policies. AWS provides the encryption tools (SSE-S3, SSE-KMS), but the customer decides whether and how to use them.
❓ Who patches the OS of an EC2 instance?
The CUSTOMER. EC2 is IaaS — AWS only manages the physical hardware. Updating the guest OS (Ubuntu, Windows Server) is the customer's responsibility.
❓ Who patches the Amazon RDS engine?
AWS. RDS is a managed service (PaaS) — AWS applies patches to the database engine automatically. The customer does NOT have access to the OS of the RDS server.
❓ Who is responsible for the physical availability of the datacenter?
AWS. Physical datacenter security, electrical redundancy, and cooling are 100% AWS's responsibility.
❓ Who configures the Security Group rules?
The CUSTOMER. Security Groups are created and configured by the customer. AWS provides them as a tool, but rule configuration belongs to the customer.
Did you get this topic?
Test what you just learned
A company is using Amazon RDS with MySQL. The security team wants to know who is responsible for applying security patches to the MySQL database engine. Who is responsible?
Put what you learned to the test with original CLF-C02 exam questions.
Start CLF-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.