Short answer: in CLF-C02 questions about the shared responsibility model, ask one thing: who can actually touch it? AWS is responsible for the security of the cloud (hardware, facilities, the managed parts of a service). You are responsible for security in the cloud (your data, identities, configuration).
The real situation behind it
A very common real-world incident: a team assumes that because S3 is “managed by AWS”, their data is protected by default, and a bucket ends up readable by anyone after a policy change. AWS kept the service secure; the configuration was the customer’s responsibility. The exam tests exactly this boundary.
Five scenarios
| Scenario | Responsible | Why |
|---|---|---|
| Patching the operating system of an EC2 instance | Customer | You control the instance OS |
| Patching the database engine of Amazon RDS | AWS | RDS is managed; you choose the maintenance window |
| Physical security of the data centers | AWS | You cannot touch the facilities |
| Who can read objects in an S3 bucket | Customer | Bucket policies and IAM are your configuration |
| Encrypting data at rest | Customer (decides and configures) | AWS provides KMS and encryption features; you choose to use them |
Practice question
This question is original, written for practice. It is not taken from the real exam.
A company runs its application on Amazon EC2 instances and stores data in Amazon RDS. Which task is the responsibility of the company under the AWS shared responsibility model?
Show the answer
Answer: B. The guest operating system of EC2 is managed by the customer. Disks, physical network and hypervisor belong to AWS.
How to read it
- “Guest operating system”, “security groups”, “IAM users”, “customer data” point to the customer.
- “Physical”, “hardware”, “hypervisor”, “global infrastructure” point to AWS.
- Managed services (RDS, Lambda, DynamoDB) move more work to AWS, but data and access stay with you.
“Shared controls” exist: patch management and configuration management are shared, because AWS patches its infrastructure and you patch your guest systems and applications.
More exam tips in the AWS Certifications hub.