Amazon AWS Certified Developer Associate – AWS Shared Responsibility

1. Shared Responsibility Model

Hello cloud gurus, and welcome to this lecture on the shared responsibility model for AWS. In this lecture we’re going to look at the three different types of shared responsibility in the AWS developer exam. It is something that can come up under the security section and it’s just important to have a highlevel overview of the different levels of shared responsibility. So we’re going to start with this figure. This is from a white paper called The AWS Security best Practices. It’s probably worth just having a quick skim through if you can, but if not, this lecture should teach you what you need to know for the exam. So infrastructure services such as Amazon’s, EC two EBS and VPC run on top of the AWS global infrastructure. So basically what this diagram is showing is what responsibilities AWS has and what responsibilities you as a customer has.

So AWS would be responsible for the AWS endpoint, they would be responsible for the global infrastructure. So this will be securing the data centers, making sure security is there 24/7. They’ll have fences around the data centers, they’ll have CCTV, they’ll have motion detectors, et cetera. They’ll have in each data hall. You’ll have basically RFID cards to get into each data hall. And those passes will actually be restricted to just the DC technicians. People like solutions architects for example, or anyone who just works for AWS in general would not be able to get into the data hall. So these are sort of standard security metrics that all managed services providers in cloud should adopt. So essentially AWS would be responsible for things like the global infrastructure. They’re also responsible for things like the foundation services.

So the compute, the storage, the databases, the networking. A good example of this was their hypervisors for EC two are all run on Zen and there was an exploit or a security bug with the Zen hypervisor and Amazon had to go through a patch all their hypervisors and then do a reboot. So this happened in 2014 and so you basically had a lot of Availability Zones or EC, two instances inside Availability Zones going down because Amazon had to reboot the hypervisors. Now, to be fair to Amazon, they gave people plenty of notice, they were very transparent about it. They said when it was going to happen and if you architected your solution properly, you shouldn’t have had an outage anyway. Then let’s have a look at this blue section.

So this is what is your responsibility as a customer. So you’re responsible for encryption, whether that be client side encryption or server side encryption. You’re responsible for protecting your network traffic. That might be things like sending things over Http versus Https. So you don’t want to send your usernames and passwords over plain text. For example, you’re responsible for your operating system network and firewall configuration. So if you leave port 22 open to the world, that’s your fault. That’s not Amazon’s fault. You’re responsible for the platform and application management and you’re responsible for your customers data. So just know the difference between what Amazon is responsible for and what you are responsible for as a customer.

And this is for Infrastructure services. Now, if we move down the white paper, you will see there’s a shared responsibility model here for container services.

Now. Container services are things such as Amazon’s RDS and Elastic MapReduce. This is where with remote Desktop with relational database Services, you will not have access into the operating system. Of those instances, you only have access to the database itself. So you could not SSH into the server that is hosting your MySQL database. Likewise, you could not RDP into the server that’s hosting your SQL database. You’re not allowed into the operating system. You’re only allowed to interact with the database itself. So in this scenario, you’ll see that Amazon are actually taking on the operating system and network configuration as well as the platform and application management. So Amazon are now responsible for patching the operating system.

They’re responsible for the platform, making sure that the platform is up and running and managing the application. You are still responsible for the Firewall configurations, however. So do remember that. So this is a model too. So this is called container services? Different to infrastructure services. So you’re slowly starting to move up the stack. That’s the infrastructure services one. And with Container Services, Amazon’s responsibilities slowly moving up the stack. And we’ll just look at the third one, which is the shared responsibility model for AWS Abstracted Services. And so the examples they give for this particular one, S Three and DynamoDB. So do remember this. This could come up in your exam. This would also apply to Lambda, in my opinion.

But this was written before Lambda was a product. So it was written in November 2013. And in this scenario, basically as a customer, you are responsible for customer data and client side data encryption and data integrity authentication. And then Amazon would be responsible for things like the platform and application management, operating system here, et cetera. Now, you’ll see, they’re saying that they’re mostly responsible for server side encryption. Do remember that if you’re providing the keys, you’re responsible for those keys.

But aside from that example, it would be Amazon’s responsibility to do the management of the keys, whether you use key management service or just the native encryption that’s built into S Three. But really what you’re responsible for here is just the customer side data encryption and then the customers data. So that is the shared responsibility model. It’s probably best just to remember the different levels. So just think of EC Two as your infrastructure, as a service level. So Amazon would only be responsible for up to the hypervisor level with your Container services.

Amazon is responsible up to the operating system and application level in terms of management and patching. So that’s with your Container services and then with your shared abstracted services. So things like S Three and DynamoDB amazon is responsible for basically everything aside from the client side encryption and the customer data. Okay. I hope that makes sense. If you have any questions, please let me know. If not, feel free to move on to the next section. Thank you.

• Category: Uncategorized