## Summary AWS frames cloud security as a shared responsibility split between itself and the customer. AWS handles security "of" the cloud — the hardware, software, networking, and facilities that run its services — while the customer handles security "in" the cloud — the guest OS, application software, and configuration of the AWS-provided security group firewall. How much falls to the customer shifts with the services used, how those integrate with the customer's IT environment, and applicable laws and regulations. ## Key Points - Security and compliance is shared: AWS protects the infrastructure, the customer protects what they put on it. - The customer manages the guest operating system, application software, and security group firewall configuration. - Customer responsibility varies by service chosen, IT integration, and regulatory requirements. - AWS managing physical-infrastructure controls relieves operational burden the customer would otherwise carry. - Controls fall into three buckets: inherited (fully from AWS), shared (both parties, separate contexts), and customer-specific. - Customers must work out how the model applies to their own use case. ## Claim Atoms - **Security of the cloud vs. security in the cloud** — AWS owns the infrastructure layer; the customer owns the OS, apps, and configuration. - **Shared controls apply to both layers in separate contexts** — e.g. AWS trains AWS employees on security, the customer trains its own. - **Inherited controls pass fully from AWS to the customer** — the customer takes credit without operating them. ## Links - [[Defense in Depth Concedes Perfect Safety Is Impossible and Optimizes for Narrow Costly Monitored Failure]] — AWS's provider/customer split shows that layered security also requires explicit ownership of each control boundary. - [[An Ops Agent Is Only as Capable as Its System Access]] — customer-side cloud responsibility starts with the access and configuration surfaces an operational agent can reach. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — connects provider, shared, and customer-specific controls to explicit ownership across the hosting stack.