Shared Responsibility Model — Complete Guide
Shared Responsibility Model — Complete Guide: free step-by-step lesson with examples, common mistakes, and interview tips — part of AWS Cloud Tutorial on Toolliyo Academy.
On this page
AWS Cloud Tutorial · Lesson 9 of 100
Shared Responsibility Model
Core services → Projects
Core services · 1 — AWS basics · ~6 min · AWS — Foundations
What is this?
AWS secures the cloud (hardware, hypervisor, physical sites). You secure what you put in the cloud: data, IAM, network rules, encryption, and patching guest OS.
Why should you care?
AwsVerse compliance teams document customer vs AWS duties for PCI and HIPAA audits.
See it live — copy this example
Run in AWS CloudShell / local AWS CLI v2, or follow the matching steps in the AWS Console (Free Tier).
# Well-Architected Security pillar checklist (excerpt)
# Customer: patch AMI, restrict SG ingress, encrypt EBS
# AWS: physical security, hypervisor isolation
aws wellarchitected list-lenses --query "LensSummaries[?LensAlias=='wellarchitected'].LensArn" --output textWhat happened?
- Lists the Well-Architected lens ARN.
- Use the WA Tool review to map your responsibilities vs managed service responsibilities.
Practice next
- Read AWS Shared Responsibility Model page for IaaS vs PaaS vs SaaS.
- For RDS: note AWS patches the engine; you control security groups.
- For EC2: you patch the OS; AWS maintains the host.
- Run S3 Block Public Access at account level.
- Enable default EBS encryption in EC2 settings.
Remember
AWS = security OF the cloud. You = security IN the cloud. Model shifts by service type.
AwsVerse PCI scope
Auditor asks who patches the database OS.
Outcome: Team maps RDS as AWS-managed engine patch, customer SG and IAM.
Interview prep for this lesson
Practice these questions aloud after reading—each links to a full structured answer.
Sign in to ask a question or upvote helpful answers.
No questions yet — be the first to ask!
