Shared Responsibility Model
Learn exactly what AWS secures versus what you are responsible for, and why this distinction matters for every architecture decision.
Shared Responsibility Model is a free AWS Solutions Architect lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS Solutions Architect learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Shared Responsibility Model
The Shared Responsibility Model splits security in two: AWS secures the cloud itself, and you secure what you build on it. It's one of the most-tested ideas on the exam.
AWS Responsibilities: Security of the Cloud
AWS handles security of the cloud — the data centres, hardware, hypervisor, and managed-service software. You can't audit it directly, but AWS holds certifications proving it.
Customer Responsibilities: Security in the Cloud
You're responsible for security in the cloud: IAM, data encryption, OS patching, and network rules. Leave an S3 bucket public, and that's on you, not AWS.
EC2: A Customer-Heavy Example
With EC2, the line is clear: AWS runs the host and hypervisor, while you handle the OS, apps, security groups, and data. An open SSH rule is yours to fix. The code finds them.
# Check for overly permissive security groups
aws ec2 describe-security-groups \
--query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]]].GroupId' \
--output textManaged Services Shift Responsibility
The more managed a service, the more AWS takes on. With RDS, AWS patches the engine; with Lambda, it runs the whole runtime; with S3, it manages everything underneath.
Data Security: Always the Customer's Job
No matter the service, protecting your data is always your job. AWS gives you the tools — KMS, encryption settings — but choosing and turning them on is up to you.
Network Security Responsibilities
AWS provides the physical network, but you configure the VPC, subnets, security groups, and NACLs. Leaving port 22 open to the world is a classic, costly mistake.
Compliance and Auditing
AWS holds many compliance certifications for its infrastructure, but you must certify your own setup. Tools like Artifact, Config, and Security Hub help you do it.
Containers: Shared Responsibility Nuance
Containers add nuance. On ECS with EC2 you manage the host; with Fargate AWS does. But the container image itself is always yours to scan and keep patched.
Applying the Model to Exam Questions
On the exam, the heuristic is simple: physical or managed-service software failures are AWS's; configuration, access, data, and OS-on-IaaS failures are the customer's.
Inherited vs Shared Controls
AWS sorts controls into three kinds: inherited (fully AWS), customer-managed (fully you), and shared (both add a layer, like patching). This taxonomy shows up on the exam.
Quick Check
Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.
Lesson Recap
You learned AWS secures the infrastructure, you secure IAM, data, OS, and config, and that more managed services shift more onto AWS. Next: IAM up close.
Frequently asked questions
Is the “Shared Responsibility Model” lesson free?
Yes — the full text of “Shared Responsibility Model” is free to read here on the web, and the AWS Solutions Architect course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS Solutions Architect course, upgrade to CoddyKit PRO.
What will I learn in “Shared Responsibility Model”?
Learn exactly what AWS secures versus what you are responsible for, and why this distinction matters for every architecture decision. You practise AWS Solutions Architect with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start AWS Solutions Architect?
No prior experience is required. AWS Solutions Architect on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Shared Responsibility Model” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this AWS Solutions Architect lesson?
Yes. Every AWS Solutions Architect lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- What Is Cloud Computing and AWS?
- AWS Global Infrastructure
- Core Service Categories Overview
- Shared Responsibility Model