What is the AWS shared responsibility model?

The shared responsibility model defines the boundary between what AWS secures and what you secure. It is summarised as AWS is responsible for security of the cloud; you are responsible for security in the cloud.

AWS is always responsible for: physical datacentres, hardware, the hypervisor, and the managed service software itself.

You are always responsible for: your data, how you classify and encrypt it, IAM configuration, network and firewall configuration, and application-level security.

Where the line sits depends on the service:

• EC2 (IaaS) — you manage the guest operating system, patching, applications, and security groups. AWS manages the hypervisor down.
• RDS (managed) — AWS patches the database engine and operating system. You manage database users, encryption settings, network access, and backups retention.
• S3 and Lambda (fully managed) — AWS manages nearly everything except your data, permissions, and configuration.

The practical consequences worth stating:

• A publicly exposed S3 bucket is a customer misconfiguration, not an AWS failure — and this remains one of the most common sources of real-world data exposure.
• AWS durability is not backup. S3's eleven nines protect against hardware loss, not against you deleting the object. Versioning and lifecycle policies are your responsibility.
• Patching an EC2 instance is yours; patching RDS is AWS's — which is itself a strong argument for managed services.