Cloud Shared Responsibility

🔥 Vibe Prompt

"Map security responsibilities for AWS services: EC2, S3, RDS, Lambda. Who secures what?"

Shared Responsibility Model

┌─────────────────────────────────────┐
│  Customer (Security IN the Cloud)   │
│  ├── Data encryption (at rest/transit)│
│  ├── OS patching (EC2)              │
│  ├── Firewall rules (SG, NACL)      │
│  ├── IAM policies & access          │
│  └── App-level security (WAF, code) │
├─────────────────────────────────────┤
│  AWS (Security OF the Cloud)        │
│  ├── Physical security (data center)│
│  ├── Network infrastructure         │
│  ├── Hypervisor isolation           │
│  ├── Managed service security       │
│  └── Global infrastructure          │
└─────────────────────────────────────┘

Responsibility by Service Type

| Service Type | Example | Customer Responsible For | |-------------|---------|------------------------| | IaaS (EC2) | Virtual server | OS, apps, firewall, patches | | PaaS (RDS) | Managed DB | Data, access, schema | | SaaS (SES) | Email service | Content, usage | | FaaS (Lambda) | Serverless | Code, dependencies, env vars |

Cloud Security Pillars

1. IAM & Access Control
   - Least privilege, MFA, roles

2. Infrastructure Protection
   - VPC, Security Groups, WAF

3. Data Protection
   - Encryption at rest (KMS), in transit (TLS)

4. Detective Controls
   - CloudTrail, GuardDuty, Security Hub

5. Incident Response
   - Automated remediation, playbooks

Cloud Security Best Practices

| Area | Practice | |------|----------| | Account | Use multiple accounts (prod, dev, logging) | | Network | VPC with private subnets, no public IPs | | Storage | S3 block public access, encrypt by default | | Compute | Use latest AMIs, scan images | | Data | Encrypt everything, rotate keys | | Monitor | Enable CloudTrail + GuardDuty + Security Hub |

AWS Security Services

┌─────────────────────────────────────────────┐
│  IAM         - Users, roles, policies       │
│  KMS         - Encryption key management    │
│  CloudTrail  - API activity logging         │
│  Config      - Resource compliance          │
│  GuardDuty   - Threat detection             │
│  Security Hub - Central security dashboard  │
│  Detective   - Root cause analysis          │
│  Macie       - Sensitive data discovery     │
│  WAF         - Web application firewall     │
│  Shield      - DDoS protection              │
└─────────────────────────────────────────────┘

Multi-Account Strategy

Organization Root
├── Security (CloudTrail, GuardDuty, Log Archive)
├── Infrastructure (Shared services: VPC, network)
├── Production (Prod workloads, strict controls)
├── Staging (Pre-prod, less strict)
└── Development (Dev, relaxed controls)

Key Questions

Who can access this resource?
Has access been revoked for leavers?
Is data encrypted at rest and in transit?
Are API calls being logged?
Are there any public S3 buckets?
Are security groups too permissive?

Chapter Summary

Understand core concepts and principles
Master implementation methods and techniques
Familiar with common issues and solutions
Able to apply in real projects