Study guide
2.1 The AWS Shared Responsibility Model
AWS Certified Cloud Practitioner CLF-C02
Track your progress as you read
Finished sections get a check mark.
1 Introduction
About the AWS Cloud Practitioner (CLF-C02) Exam Study Strategies and Exam Tips
2 Domain 1: Cloud Concepts (24%)
1.1 What Is Cloud Computing? 1.2 Cloud Deployment Models 1.3 AWS Well-Architected Framework 1.4 Cloud Migration Strategies 1.5 Cloud Economics
3 Domain 2: Security and Compliance (30%)
2.1 The AWS Shared Responsibility Model 2.2 AWS Identity and Access Management (IAM) 2.3 AWS Security Services 2.4 Compliance and Governance 2.5 Network Security
4 Domain 3: Cloud Technology and Services (34%)
3.1 AWS Compute Services 3.2 AWS Storage Services 3.3 AWS Database Services 3.4 AWS Networking and Content Delivery 3.5 Management and Governance Services 3.6 AI/ML and Analytics Services 3.7 Application Integration and Other Services
5 Domain 4: Billing, Pricing, and Support (12%)
4.1 AWS Pricing Models 4.2 Billing and Cost Management Tools 4.3 AWS Support Plans 4.4 Additional Billing Concepts and Services
6 AWS Services Deep Dive
5.1 Compute Services Deep Dive 5.2 Storage and Database Deep Dive 5.3 Security Services Deep Dive 5.4 Architecture Best Practices and Design Principles 5.5 Practice Exam — Mixed Domain Questions
2.1 The AWS Shared Responsibility Model
Key Takeaways Explain This Topic AI
AWS is responsible for security OF the cloud: physical infrastructure, hardware, networking, the hypervisor, and managed-service infrastructure.
The customer is responsible for security IN the cloud: data, IAM, OS patching on EC2, application config, encryption, and network/firewall rules.
Responsibility shifts by service type — EC2 (IaaS) gives the customer the most responsibility, while RDS, Lambda, and S3 shift more to AWS.
Data classification, encryption, and IAM configuration are ALWAYS the customer's responsibility, regardless of the service.
The Shared Responsibility Model is the single most heavily tested concept on the CLF-C02 exam.
Last updated: June 2026
Quick Answer: AWS manages security OF the cloud (physical data centers, hardware, networking, hypervisor, and the infrastructure of managed services). You manage security IN the cloud (your data, IAM configuration, OS patches on EC2, encryption, and network/firewall rules). This is the #1 most tested concept on the CLF-C02 exam.
The Shared Responsibility Model is arguably the single most important concept on the CLF-C02 exam. AWS and the customer share security duties, and you must know exactly where the line falls for different service types.
The Core Concept
Think of it like renting an apartment. The landlord (AWS) is responsible for the building structure, roof, plumbing, electrical, and common areas. The tenant (you) is responsible for your furniture and belongings, locking the door, and not leaving the stove on. AWS secures the building; you secure what you put inside and how you use it.
AWS Responsibilities: Security OF the Cloud
- Category What AWS Manages
- Physical Data centers, physical access control, environmental controls (fire, flood, power)
- Hardware Servers, storage devices, networking equipment
- Networking Global network infrastructure and backbone connectivity between Regions
- Hypervisor The virtualization layer that isolates customer instances
- Managed Service Infrastructure The underlying platform for managed services (RDS engine, Lambda runtime)
- Edge Locations Physical infrastructure for CloudFront and other edge services
- Customer Responsibilities: Security IN the Cloud
- Category What You Manage
- Data Your data, its classification, and encryption
- Identity & Access IAM users, groups, roles, policies, and MFA
- Operating System OS patching and maintenance on EC2 instances
- Network Configuration Security Groups, NACLs, route tables, VPC design
- Application Application-level security, code, and updates
- Firewall Host-based and network firewalls
- Encryption Client-side and server-side encryption choices
- How Responsibility Shifts by Service Type
The amount of customer responsibility depends on the service type — the more managed the service, the less you handle.
IaaS (Amazon EC2): Customer manages the most — guest OS patches, application software, Security Groups, and data encryption. AWS manages the hypervisor and below.
Managed services (Amazon RDS): Shared. AWS handles OS and database-engine patching and hardware; you handle database settings, Security Groups, IAM, data encryption, and backup configuration.
Serverless (AWS Lambda) and fully managed (Amazon S3): AWS manages the most. Your duties shrink to your code/data, IAM permissions, and encryption configuration.
- Responsibility EC2 (IaaS) RDS (Managed) Lambda (Serverless) S3 (Fully Managed)
- Physical infrastructure AWS AWS AWS AWS
- Hypervisor AWS AWS AWS AWS
- Operating System Customer AWS AWS AWS
- Database Engine Customer AWS AWS N/A
- Network Config Customer Customer Customer Customer
- Data Encryption Customer Customer Customer Customer
- IAM Permissions Customer Customer Customer Customer
- Always the Customer's Responsibility (Any Service)
- Data classification and encryption — deciding what to protect and enabling encryption
- IAM management — creating users, assigning least-privilege permissions, enabling MFA
- Security Group / firewall configuration — controlling inbound and outbound traffic
- Customer-specific compliance — meeting your regulatory obligations using AWS tools
- Protecting data in transit and at rest — selecting and configuring encryption
- Always AWS's Responsibility (Any Service)
- Physical data-center security — guards, cameras, biometric access
- Hardware maintenance — replacing failed drives, servers, and network gear
- Network infrastructure — global backbone and infrastructure-level DDoS protection
- Hypervisor and host OS — securing the virtualization platform
- Environmental controls — power, cooling, and fire suppression
On the Exam: When you see a Shared Responsibility question, ask: "Is this about the physical infrastructure or about software configuration?" Physical = AWS. Configuration = Customer. And when in doubt, data and encryption are ALWAYS the customer's job , regardless of the service.
Worked Scenarios
Apply the model to a few common scenarios. A customer stores files in Amazon S3 but leaves a bucket world-readable and unencrypted: the exposure is the customer's fault, because data protection and access configuration are always the customer's job, even though AWS secures the underlying hardware. A failed physical disk in an AWS data center is replaced by AWS with no customer involvement. A missing security patch on a long-running EC2 instance is the customer's responsibility, while the same patch on the RDS engine is AWS's . Walking through "physical vs. configuration vs.
data" for each scenario is the fastest way to answer these questions correctly under time pressure.
Inherited, Shared, and Customer-Specific Controls
AWS describes three control categories that help clarify the split. Inherited controls are fully provided by AWS, such as physical and environmental data-center controls — the customer inherits them automatically. Shared controls apply to both layers; for example, patch management means AWS patches the infrastructure while the customer patches the guest OS and applications, and configuration management means AWS configures host devices while the customer configures their own guest operating systems, databases, and applications.
Customer-specific controls are entirely the customer's, such as classifying data and meeting industry-specific regulations using AWS tools. On the exam, "shared controls" like patching and configuration are common distractors — read carefully to see which layer the question is asking about.