Security of the cloud vs security in the cloud

The one AWS idea that clears up most cloud security confusion: AWS secures the cloud, you secure what you put in it. Getting that line wrong is where the breaches come from.

Here is the AWS idea that clears up the most confusion once it lands: AWS secures the cloud, and you secure what you put in it. There is even a name for it, the shared responsibility model, and a large share of cloud security mistakes come from getting that line wrong.

AWS handles security of the cloud

That covers the parts you never see. The physical data centres with their guards and locked cages, the servers and networking hardware, and the hypervisor that keeps your virtual machine walled off from a stranger's on the same physical box. You could not fix those even if you wanted to, and you do not need to. AWS runs them.

You handle security in the cloud

Everything you configure is yours to get right. Who can log in and what they are allowed to touch (IAM users, roles and permissions), which ports your firewall leaves open (security groups), whether your data is encrypted, and on a plain server, keeping the operating system patched.

The line moves with the service

This is the part people miss. The more managed the service, the more AWS takes on. Rent a bare EC2 instance and patching the OS is your job. Use something serverless like Lambda, or object storage like S3, and AWS looks after the machine underneath, so your job shrinks to access rules and the data itself.

• EC2: AWS keeps the hardware and hypervisor safe. You patch the OS, set the firewall, and manage the app.
• S3: AWS keeps the storage durable. You decide who can read the bucket and whether it is encrypted.
• Managed databases like RDS: AWS patches the engine. You still control access and backups.

AWS secures the building. You are still responsible for locking your own door.

The famous cloud breach story is almost always the same shape: a storage bucket left open to the public internet. That is not AWS failing at security of the cloud. That is a setting on the customer's side of the line. Learn where the line sits for each service and most of the mystery around cloud security quietly disappears.