Responsibility Shift by Service Type in AWS
Why This Is Important
Understanding how security responsibilities shift based on AWS service types is fundamental to the AWS Cloud Practitioner exam. AWS offers different service models, and your security obligations change dramatically depending on which model you use. This concept helps you make informed decisions about which services to use and ensures you properly secure your workloads.
What Is Responsibility Shift by Service Type?
The AWS Shared Responsibility Model divides security duties between AWS and the customer. However, these duties are not static—they shift based on the type of service you consume. AWS categorizes services into three main types:
Infrastructure Services (IaaS) - Examples: EC2, EBS, VPC
Customer manages: Operating system, network configuration, firewall settings, application code, data encryption, identity management
AWS manages: Physical hardware, facilities, network infrastructure, hypervisor
Container Services (PaaS) - Examples: RDS, Elastic Beanstalk, ECS
Customer manages: Network controls, firewall rules, identity and access management, data, some platform configurations
AWS manages: Operating system, platform patching, underlying infrastructure
Abstracted Services (SaaS) - Examples: S3, DynamoDB, Lambda, SQS
Customer manages: Data classification, access policies, client-side encryption choices
AWS manages: Almost everything else including infrastructure, platform, and server-side security
How It Works
Think of it as a spectrum of control versus convenience:
1. More Control = More Responsibility
When you use EC2, you get full control over the operating system. This means you must patch it, configure firewalls, install antivirus, and manage all security aspects above the hypervisor level.
2. Less Control = Less Responsibility
When you use Lambda, you write code and configure triggers. AWS handles server provisioning, OS patching, scaling, and infrastructure security. Your focus narrows to code security and proper IAM permissions.
3. Data Responsibility Is Always Yours
Regardless of service type, you are always responsible for your data, including classification, encryption decisions, and access controls.
Practical Examples
EC2 Instance: You must install security patches, configure security groups, manage SSH keys, and ensure proper IAM roles.
RDS Database: AWS patches the database engine. You configure security groups, manage database users, enable encryption, and control network access.
S3 Bucket: AWS secures the storage infrastructure. You configure bucket policies, access control lists, encryption settings, and versioning.
Lambda Function: AWS manages all compute infrastructure. You secure your code, set appropriate IAM execution roles, and manage environment variables securely.
Exam Tips: Answering Questions on Responsibility Shift by Service Type
1. Identify the Service Type First
When a question mentions a specific AWS service, categorize it as Infrastructure, Container, or Abstracted. This helps determine who is responsible for what.
2. Remember the Data Rule
Customer data security is ALWAYS the customer's responsibility, regardless of service type. If a question asks about data encryption or data classification, the answer typically involves customer responsibility.
3. Physical Security Is Always AWS
Any question about data center security, hardware disposal, or physical access control—the answer is AWS responsibility.
4. Operating System Questions
If the question involves OS patching on EC2, the customer is responsible. For managed services like RDS or Lambda, AWS handles this.
5. Look for Keywords
Customer responsible: data, access management, firewall configuration, application security, identity management
AWS responsible: physical security, hardware, hypervisor, managed service infrastructure
6. Managed vs Unmanaged
Questions often contrast managed services with unmanaged ones. Managed services shift more responsibility to AWS.
7. Elimination Strategy
When unsure, eliminate answers that assign physical infrastructure responsibilities to customers or data responsibilities to AWS.
8. Context Matters
Read questions carefully. A question about network security for EC2 differs from network security for Lambda. The service context changes the correct answer.