Instructor: Welcome to this section
on security and compliance.
We're going to start right away with the shared
responsibility model.
So this is something we've seen all along this course,
but now it is time for us to formally introduce it.
So, AWS responsibility is the security of the cloud.
That means that all the infrastructure they provide to you,
that includes the hardware, the software facilities,
networking.
They have to protect it
because this infrastructure will run
all the services that you're using on AWS.
On top of it, any service that is managed by AWS,
such as S3 DynamoDB, RDS, is the responsibility of AWS.
But once they provide a service to you,
then how you use that service is your responsibility.
So for example, as a customer,
you are responsible for the security in the cloud.
So in the instance of EC2 instance, your customer,
so you, is responsible for the management of all the
operating system that includes patching the operating system
and making updates to it.
You must configure the firewall,
so that means that's you Mister Green figure, for example,
the network ACL and the security group,
and also you need to make sure that your EC2 instance has
the correct IAM information through the use of,
IAM instance role.
Then, we also need to ensure that we
encrypt the application data,
according to our compliance requirements.
Then, there are some controls that are shared.
For example, patch management, configuration management,
awareness and training are both shared between you and AWS.
For example, for batch managements,
if using something like RDS,
then AWS will do the patch management for us.
And if we are using something like EC2 then we have to
patch our operating system,
so the shared control is here.
For example, for awareness and training,
AWS has to train their employees
to use their facilities correctly,
and to make sure they adhere to their security guidelines.
And you have to make sure to train your employees correctly,
to use the cloud,
and doing this training is one of these ways, obviously.
Next, let's look at a detailed technology, for example.
So for RDS,
the responsibility of AWS is to manage the underlying
EC2 instance and to the civil SSH access,
to automate the database patching,
to automate the operating system patching,
and to edit the underlying instance and disk
to guarantee that it functions over time.
Your responsibility as a user of RDS
is to check that the ports,
IP security groups inbound rules
in your database security group are set up correctly.
It's also to make sure that the in-database user creation
and the permission of these users is done the way you want,
and also you need to make sure that if you want to create a
database with or without public access.
And if you wanted to configure a database you could use
parameter groups, for example,
to force only encrypted connections.
Finally, if you wanted to encrypt the data
within the database, it is again,
your responsibility to enable.
Next, for Amazon S3,
The responsibility of AWS is to guarantee you
to get unlimited storage,
to guarantee you to get encryption when you enable it,
and to ensure the separation of data between all your,
all the different customers of AWS.
As well, they need to make sure
that all the employees of AWS can not access your data.
Your responsibility is to configure your bucket
the way you want to make sure
the bucket policy adheres to your standards,
and also to use IAM users and roles accordingly.
And finally, if you want to encrypt your data,
it is your responsibility to enable it and to use the
encryption scheme that works for you.
So, hopefully that makes sense.
Here is a diagram from the website of AWS,
which shows the responsibility in the cloud is a customer
and responsibility of the cloud is for AWS.
So as a customer, your data,
the applications, the platform,
identity, and access management is up to you,
operating system, network and firewall configuration,
as well.
Then your client's side data encryption,
your server-side encryption,
and your network traffic protection is all yours.
AWS instead, is responsible for their software,
so their services,
also making sure that the compute, storage, database,
and networking are working correctly when they
provide it to you,
and they're responsible for their hardware
and the global infrastructure.
So the regions, the AZ, and the edge locations.
Hopefully that makes sense because their shared
responsibility comes up at least two to three questions
in your exam.
So understanding what is your responsibility
and what is the responsibility of AWS is very important.
I hope that was helpful
and I will see you in the next lecture.