AWS shared responsibility model

The AWS shared responsibility model separates security of the cloud from security in the cloud. AWS is responsible for protecting the infrastructure that runs its services, including physical facilities, hardware, networking, and the virtualization layer. Customers are responsible for their data, identities, access permissions, workload configurations, and other controls that remain within their authority. This division also applies to compliance: AWS can provide evidence about its controls, but customers must demonstrate that their own use of the services satisfies applicable requirements.

The exact boundary depends on the service. With Amazon EC2, AWS operates the underlying infrastructure, while the customer manages the guest operating system, patches, installed applications, instance roles, and security group rules. With Amazon S3, AWS manages the service infrastructure and operating environment, while the customer controls matters such as bucket policies, public access settings, data classification, and applicable encryption configuration. A managed service transfers some operational duties to AWS; it does not eliminate customer accountability for access or data protection.

Engineers apply the model by mapping each compliance requirement to a control, a responsible party, and supporting evidence. For a physical access requirement, relevant AWS assurance reports may provide evidence for the provider-operated infrastructure. For a requirement to restrict administrative access, the customer must show appropriate IAM policies, authentication controls, and access reviews. Some control categories are shared: AWS patches its infrastructure, and customers patch the components they manage. The responsibilities address different layers rather than both parties performing the same task on the same resource.

AWS Artifact provides access to AWS security and compliance reports and certain agreements. These documents help customers evaluate AWS-operated controls and determine whether relevant services, Regions, and reporting periods are covered. An AWS report is not evidence that a customer's bucket policy, identity configuration, or application is secure. Customers must also check whether a report identifies complementary controls that they need to implement.

AWS Audit Manager has been in maintenance and closed to new customers since March 31, 2026; existing customers can continue using it to collect and organize evidence for assessments using frameworks and controls. Depending on the control and configuration, evidence can come from AWS API activity, resource configuration snapshots, compliance checks, or manual uploads. Engineers should configure the assessment scope, review evidence relevance, assign reviewers, and supply manual evidence for activities such as policy approval or staff training. An assessment report supports an audit; it is not a certification, and collecting evidence does not automatically establish that every control is effective.

For existing AWS Audit Manager customers, a practical workflow combines AWS Artifact reports for provider responsibilities with AWS Audit Manager evidence for customer responsibilities. AWS Config can record resource configurations and evaluate configured rules, while AWS CloudTrail can provide records of account activity. For example, a team investigating an S3 access-control requirement might use configuration evidence to show bucket settings, activity records to identify policy changes, and an approved access review as manual evidence.

The main trade-off is reduced infrastructure management in exchange for a continuing need to understand service-specific boundaries. Outsourcing infrastructure does not outsource legal obligations, risk decisions, or accountability for customer-controlled settings. Common mistakes include treating a compliant AWS service as a compliant application, assuming managed services require no security configuration, and confusing evidence collection with remediation. A sound implementation explicitly assigns ownership, verifies control effectiveness, and preserves evidence that matches the audit scope and period.