☁️
CTHFM: AWS
  • Welcome
  • Getting Started
    • Account Setup
  • AWS CLI
    • AWS CLI Overview
    • Installation
  • AWS Fundamentals
    • AWS Documentation
    • AWS Shared Responsibility Model
    • Organizational Hierarchy
    • AWS Principals
    • IAM Fundamentals
      • IAM Policy Components
      • IAM Documentation References
    • AWS Security Services Overview
    • AWS Core Services
    • AWS Frameworks
    • Regions and Availability Zones
  • SQL
    • SQL Refresher for Threat Hunting
  • Logging Reference
    • Cloudtrail
      • What is Cloudtrail?
      • Setting Up Cloudtrail
      • Cloudtrail Events Structure
      • Filtering and Searching CloudTrail Logs
      • IAM ID Prefixes
      • Additional Resources
      • API References
    • VPCFlow Logs
    • GuardDuty
      • Multi-Account Setup
      • GuardDuty Concepts
      • GuardDuty Finding References
      • S3 Protection
      • Malware Protection
        • EC2 Malware Protection
          • EC2 Protection Resources
          • Monitoring Scans
          • EC2 Malware Protection Events: CloudWatch
        • S3 Malware Protection
          • Enabling S3 Malware Protection
          • After Enabling S3 Malware Protection
          • S3 Malware Resource Plan Status
          • S3 Malware Protection Quotas
      • RDS Protection Enablement
      • Lambda Protection Enablement
      • Trusted IP Lists and Threat Lists in Amazon GuardDuty
      • Remediation Recommendations
      • GuardDuty API Reference
      • GuardDuty Quotas
    • Access Analyzer
      • Setup
      • External Access and Unused Access Analyzer Findings
      • Review Findings
      • Access Analyzer Resources
      • Access Analyzer API Reference
    • AWS Network Firewall
      • Permissions
      • Firewall Log Contents
      • Logging Destinations
      • CloudWatch Firewall Metrics
    • AWS Config
      • Resource Management in AWS Config
      • AWS Config Integrations
      • AWS Config Resources
      • Configuration Item
      • Config Rules
        • Evaluation Modes
  • CloudWatch
    • Amazon CloudWatch
      • CloudWatch Concepts
      • CloudWatch Metrics
        • Filter Pattern Syntax
      • CloudWatch Alarms
        • Alarm Recommendations
      • Subscriptions
      • CloudWatch Agent
      • CloudWatch Insights
        • Supported Logs and Discovered Fields
        • CloudWatch Insights Query Syntax
      • Anomaly Detection
        • Create Anomaly Detector
        • Alarms for Anomaly Detections
      • CloudWatch Filter Syntax
      • CloudWatch Service Quota
  • Athena For Threat Hunting
    • Introduction to Athena
    • Setting Up Athena
    • SQL For Threat Hunters
    • Automated Response
    • Query Best Practices
  • AWS Security Research and Resources
    • AWS Security Blog
    • AWS Goat
    • Cloud Goat
    • Pacu
    • Prowler
    • Scout Suite
  • Threat Hunting in AWS
    • Threat Hunting in AWS
    • Threat Hunting Introduction
    • Threat Hunting Process
      • Hypothesis Generation
      • Investigation
      • Identification
      • Resolution & Follow Up
    • Pyramid of Pain
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Att&CK Data Sources
      • MITRE Att&CK Mitigations
    • MITRE Att&ck: AWS
      • MITRE Att&CK Matrix
      • Amazon Web Services Security Control Mappings
    • AWS Threat Hunting Ideas
      • AWS Threat Hunting Ideas: EC2
      • AWS Threat Hunting Ideas: Lambda
      • AWS Threat Hunting Ideas: SQS
      • AWS Threat Hunting Ideas: SNS
      • AWS Threat Hunting Ideas: RDS
Powered by GitBook
On this page
  • Overview
  • 1. Security OF the Cloud (AWS’s Responsibility)
  • 2. Security IN the Cloud (Customer’s Responsibility)
  • 3. Shared Controls
  • Summary Table
  1. AWS Fundamentals

AWS Shared Responsibility Model

PreviousAWS DocumentationNextOrganizational Hierarchy

Last updated 8 months ago

Overview

The AWS Shared Responsibility Model defines the distribution of security responsibilities between AWS and the customer, ensuring that both parties understand their respective roles in securing the cloud environment. This model divides responsibilities into two primary areas: Security OF the Cloud and Security IN the Cloud.

1. Security OF the Cloud (AWS’s Responsibility)

AWS is responsible for securing the underlying infrastructure that runs the services offered in the AWS Cloud. This includes the physical, network, and hypervisor layers that support its cloud offerings. Some specific areas covered by AWS include:

  • Data Centers:

    • Security of physical locations (e.g., access control, surveillance, climate management).

    • Protection from disasters (e.g., power redundancy, environmental controls).

  • Hardware & Software Infrastructure:

    • Maintenance and security of the networking equipment, storage, and servers.

    • Securing virtualization layers like Amazon EC2 hypervisors.

  • Global Infrastructure:

    • Ensuring secure connectivity and high availability across Availability Zones and Regions.

    • Protection against DDoS attacks using AWS Shield.

  • Compliance Controls:

    • AWS maintains industry-standard compliance certifications such as SOC 1/2/3, ISO 27001, PCI DSS, and HIPAA.

Example AWS Responsibilities:

  • Patching and updating AWS-managed services (like RDS, DynamoDB).

  • Availability of compute, storage, and network services.

  • Securing the infrastructure and the management of physical assets.

2. Security IN the Cloud (Customer’s Responsibility)

Customers are responsible for managing the security of the workloads, data, and applications they deploy in the AWS Cloud. This responsibility varies based on the specific AWS service being used (IaaS, PaaS, or SaaS).

Customers have the flexibility to build their applications, configure their security settings, and store data, but they must ensure these are secured.

  • Identity and Access Management (IAM):

    • Creating and managing user accounts, roles, and permissions using IAM policies.

    • Applying least privilege principles to restrict access to resources.

  • Data Protection:

    • Encrypting data at rest (e.g., using AWS KMS) and in transit (e.g., with TLS).

    • Managing key rotation and lifecycle.

  • Network Security:

    • Configuring security groups, network ACLs, and VPC settings.

    • Setting up firewalls and using AWS WAF to prevent malicious access.

  • Application Security:

    • Hardening the application code and securing APIs.

    • Regularly testing for vulnerabilities using tools like Amazon Inspector.

  • Monitoring & Logging:

    • Monitoring the environment using CloudTrail and CloudWatch Logs.

    • Setting up GuardDuty to detect unusual activities or possible threats.

  • Patch Management:

    • Managing the updates and patches of OS and application software on EC2 instances.

Example Customer Responsibilities:

  • Encrypting sensitive data in an S3 bucket.

  • Ensuring secure configurations for virtual machines (EC2) or containers (ECS, EKS).

  • Defining backup policies and disaster recovery strategies.

3. Shared Controls

Some controls require shared responsibility, where both AWS and the customer play a role. Examples include:

  • Patch Management:

    • AWS manages patching for managed services like Amazon RDS.

    • Customers manage patching for operating systems running on EC2 instances.

  • Configuration Management:

    • AWS provides tools like AWS Config to monitor and assess configurations.

    • Customers must configure these services according to their compliance needs.

  • Incident Response:

    • AWS ensures availability of tools like CloudTrail for auditing.

    • Customers are responsible for monitoring these logs and responding to incidents.

Summary Table

Responsibility

AWS

Customer

Infrastructure Security

Data center, hardware, hypervisors

Configuring secure workloads

Identity Management

IAM platform availability

Defining user roles and permissions

Data Encryption

Provides encryption tools

Configuring encryption & key rotation

Patch Management

Patching AWS-managed services

Patching OS and apps on EC2

Network Security

Global infrastructure security

Configuring VPC, security groups, NACLs

Monitoring

Provides CloudTrail, CloudWatch

Setting up alerts and monitoring logs