🔐 Shared Responsibility Model (IAM Focus)
This shows up constantly on the CCP exam. The whole idea boils down to one split: what AWS handles, and what you handle.
🏗️ AWS's side
AWS covers everything underneath the services themselves:
Data centers and physical hardware
Global network security
Configuring and patching AWS services
Vulnerability analysis of their own infrastructure
Compliance and certifications
In short: AWS secures the cloud.
👤 Your side — everything inside IAM
Everything happening inside your account is on you.
Identity management — creating and maintaining users, groups, roles, and policies. AWS won't do this for you.
Permissions — deciding who gets what, managing policies, and keeping an eye on access. AWS hands you the tools; how you use them is your call.
Security practices — turning on MFA, rotating access keys. None of this happens automatically.
Monitoring — actually reviewing permissions and access patterns, using tools like the Credentials Report and Access Advisor.
🎯 The easy way to remember it
AWS secures the cloud. You secure what's in it.
🚀 Why it matters
This trips people up because many assume AWS handles everything. It doesn't — misunderstanding this line is exactly what leads to weak permissions and real security gaps.