What's changed: In-scope coverage: added a security/identity in-scope services block to Ch5 (IAM Identity Center/Cognito/Directory Service/Certificate Manager/CloudHSM/Firewall Manager/Detective/Audit Manager)
5.1The Shared Responsibility Model and IAM
Understand the AWS shared responsibility model (AWS secures "of the cloud," you secure "in the cloud") and IAM users, groups, roles, policies, least privilege, and protecting the root user.
Cloud security is shared between AWS and you. Knowing what AWS secures and what you secure is the starting point. The mnemonic is simple: AWS = security "of" the cloud, you = security "in" the cloud. On your side, IAM is central—managing "who can do what" with least privilege.
5.1.1The shared responsibility model
- AWS: "security of the cloud"—physical hardware, Regions/AZs/edge, and the underlying managed-service infrastructure.
- You: "security in the cloud"—your data, IAM config, OS/network/firewall config, encryption, and application security.
- The boundary shifts by service (e.g., with EC2 you own the OS; with S3 or Lambda your share is smaller).
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.