The Shared Responsibility Model
Think of renting an apartment. The building owner is responsible for the locks on the front door, the security cameras in the lobby, and the structural integrity of the walls. You are responsible for locking your apartment door, not leaving your laptop on the windowsill, and not giving your key to strangers. AWS works the same way.
AWS is responsible for security OF the cloud — the physical data centers, the network hardware, the hypervisors running your virtual machines. You are responsible for security IN the cloud — your data, your IAM permissions, your network ports, your application code. This boundary is called the Shared Responsibility Model, and understanding it is the foundation of every AWS security decision you will ever make.
To secure your workload effectively, you need a layered approach — often called Defense in Depth. No single control is sufficient. If an attacker bypasses your firewall, encryption should protect your data. If an attacker steals credentials, threat detection should catch the anomalous behavior. The layers are:
- Protect the Data: Encryption at rest and in transit (KMS), and sensitive data discovery (Macie).
- Protect the Perimeter: Application-layer firewalls (WAF) and volumetric DDoS protection (Shield).
- Watch for Trouble: Continuous intelligent threat detection (GuardDuty).
This topic covers the specific services that form this Defense in Depth strategy, how each one works mechanically, and how they integrate with each other.