Security and Compliance
Shared Responsibility by Service Model
CoreLearn how AWS and customer security responsibilities divide, overlap, and shift as a service manages more of the technology stack.
Aligned to the current CLF-C02 exam guide, verified August 15, 2026.
Why this matters
Shared responsibility appears throughout CLF-C02. The key is to identify the layer in question and then account for whether the workload uses infrastructure, a managed service, or serverless compute.
Must Know
- AWS protects the physical data centers, hardware, global infrastructure, and foundational service infrastructure.
- Customers classify and protect their data, configure access, and manage the settings they control.
- On Amazon EC2, the customer patches and secures the guest operating system, installed applications, and host-based firewall configuration.
- With Amazon RDS, AWS manages the underlying infrastructure and supported database platform operations, while the customer controls data, database access, and configuration choices.
- With AWS Lambda, AWS manages servers and the runtime infrastructure; the customer manages function code, dependencies, permissions, configuration, and data.
- Responsibility can be shared when both sides perform different parts of one control, such as AWS providing patching capabilities while the customer chooses and configures the portions still under customer control.
Compare and Distinguish
- Security of the cloud vs security in the cloud: AWS secures the infrastructure that runs AWS; customers secure what they deploy, store, and configure on AWS.
- Amazon EC2 vs Amazon RDS: EC2 customers manage the guest OS and database software they install; RDS shifts supported database platform and underlying infrastructure operations to AWS.
- Amazon EC2 vs AWS Lambda: EC2 provides operating-system control and responsibility; Lambda removes server management but leaves code, permissions, data, and configuration with the customer.
- AWS responsibility vs shared control: an AWS-managed platform layer is an AWS duty, while controls such as configuration management can include actions by both AWS and the customer.
Scenario examples
- Scenario: An EC2 instance needs an operating system security update. Think: The customer patches the guest operating system because it is above the AWS-managed infrastructure layer.
- Scenario: A company runs a database in Amazon RDS and needs to restrict who can read its records. Think: AWS manages the service infrastructure, but the customer controls access to its data.
- Scenario: A Lambda function has permission to read more data than it needs. Think: The customer must narrow the function permissions even though AWS manages the servers.
- Scenario: A failed physical disk in an AWS data center must be replaced. Think: Physical hardware is part of security of the cloud and is AWS responsibility.
Exam traps
- Do not assume that moving to a managed or serverless service makes AWS responsible for customer data or IAM permissions.
- Do not assign guest operating system patching on an EC2 instance to AWS merely because EC2 runs in an AWS data center.
- Do not treat the model as a fixed list that is identical for every service; the managed-service boundary matters.
- Do not confuse customer enablement tools, documentation, or Support plans with a transfer of accountability.
Key takeaways
- AWS secures the cloud; customers secure their use of the cloud.
- Data, identities, permissions, and exposed configuration remain customer concerns.
- More managed services shift more infrastructure work to AWS, not all security work.
- EC2: customer manages the guest OS. RDS: AWS manages more of the database platform. Lambda: AWS manages servers and runtime infrastructure.
How it works
- AWS publishes the shared responsibility model and service documentation that identify the boundary for each offering.
- AWS operates and protects the infrastructure below that boundary. Customers configure identities, data protection, networks, logging, and application behavior above it as applicable.
- As customers choose more abstracted services, AWS operates more layers, while customers retain responsibility for their workload decisions and content.
When to use it
- Use the model whenever a scenario asks who patches, configures, protects, monitors, or owns a particular layer.
- Compare service models before assigning responsibility; the answer for EC2 might differ from the answer for RDS or Lambda.
- Use service documentation to confirm the boundary when a real workload has requirements beyond the exam-level examples.
Security and governance implications
- Protect customer-controlled identities and permissions with least privilege and strong authentication.
- Classify data and choose appropriate encryption, backup, logging, and network controls for the selected service.
- Confirm that managed-service defaults and optional controls meet the organization's requirements.
Troubleshooting signals
- When ownership is unclear, isolate the affected layer and determine whether AWS or the customer administers it for that service.
- For a misconfiguration, separate a service malfunction from an incorrect customer setting before deciding who must act.
More detail
- Think of the stack from facilities upward: physical site, hardware, virtualization, operating system, application, identity, and data. AWS always owns the foundational cloud infrastructure. The customer portion begins at a different layer depending on the service.
- Customer-controlled configuration is a recurring exam clue. AWS can provide encryption, logging, resilience, and access-control features, but the customer decides how to enable and configure the applicable features for its workload.
- For a self-managed database on EC2, the customer manages the guest OS and database engine. RDS shifts supported platform operations to AWS. In either case, the customer remains responsible for data governance and appropriate access.
- Shared controls do not mean vague or duplicated ownership. Each party performs a defined part of the control within the layer it manages.
Ready for the quiz?
- Who patches the guest operating system on an Amazon EC2 instance?
- Which responsibilities remain with a customer that uses AWS Lambda?
- How does the responsibility boundary differ between a database on EC2 and Amazon RDS?
- Why does an AWS compliance certification not make a customer workload automatically compliant?
Related objectives
- D2.1