# Shared responsibility: AWS secures the cloud, IAM is your perimeter Source: https://ai.techclick.in/blog_aws_shared_responsibility_iam Markdown: https://ai.techclick.in/blog_aws_shared_responsibility_iam.md Publisher: Techclick Infosec Pvt Ltd AWS secures the cloud; you secure in the cloud. IAM is the perimeter. Root is not a daily user. Dummy 111122223333. ## The ticket Priya’s laptop has a screenshot of the root console for account 111122223333 . Yesterday she created sg-web as root. Today the same password is in a shared chat. That is not an AWS outage. That is you handing over the account. Quick interview answer AWS Shared Responsibility Model: AWS secures the cloud (regions, hardware, hypervisor, managed-service plane). You secure in the cloud — customer data, IAM, guest OS, security groups, encryption choices, application. The more managed the service, the less OS work you do; identity and data stay yours. Root is the account owner, not a daily user. Humans use IAM Identity Center . Workloads assume roles. Long-lived access keys are not a login method. Hero · two sides of the line The hypervisor is theirs. The access key on the laptop is yours. Lab data · dummy only Account 111122223333 · OUs Security / Workloads · hub VPC 10.50.0.0/16 · app VPC 10.51.0.0/16 · SG sg-web · NACL acl-app · bucket tc-lab-app-logs · role AppEC2Role · TGW tgw-lab · VGW public 203.0.113.60 · on-prem FortiGate WAN 203.0.113.10 . Dummy account ID. Not yours. ## Mental model Service style AWS still owns You still own EC2 in app VPC 10.51.0.0/16 Host, hypervisor, facilities Guest OS, sg-app , IAM role, data, patches S3 tc-lab-app-logs Storage plane, durability of the service Block Public Access, bucket policy, encryption, objects Lambda / managed Runtime host and patching Code, execution role, secrets, what the function can reach The line AWS · of the cloud regions, hardware, hypervisor - You · in the cloud IAM, data, OS, SG, KMS choices IAM sits on your side. A VPC is not a substitute for identity. ## How to choose Who How they enter 111122223333 Never Human (Priya) IAM Identity Center permission set → temporary creds Root, long-lived IAM user access keys EC2 / app Instance profile AppEC2Role Keys in user-data or ~/.aws Break-glass Root + hardware MFA, offline, rare Shared root password in chat https://111122223333.signin.aws.amazon.com/console Training mock · not live AWS console VPC IAM S3 CloudTrail IAM → Dashboard ### Account 111122223333 · identity hygiene Root MFA Enabled — hardware preferred, not a daily login Root access keys None Human access IAM Identity Center (SSO) — no IAM user keys Workload role AppEC2Role · instance profile Caller check aws sts get-caller-identity Cancel Save IAM is the perimeter. Root is the owner, not a teammate. Training mock. ## Runbook #### Side A — who am I aws sts get-caller-identity . If the ARN is root or a personal IAM user with access keys, stop. Identity Center assumed-role is the expected human path. - #### Side B — root lock Root: MFA on, no access keys, no daily console. Delete any root keys. Humans get permission sets, not AdministratorAccess pasted on an IAM user. - #### Side C — prove the split Name one thing AWS patches for you (hypervisor) and one thing you patch (guest OS on the app VPC instance). Write it on the ticket. aws cli · dummy 111122223333 aws sts get-caller-identity # Account: 111122223333 # Arn: arn:aws:sts::111122223333:assumed-role/AWSReservedSSO_SecurityAudit_aabb/priya aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled' # 1 aws iam list-access-keys --user-name root # do not create these; empty is the proof ## Four failures ### 1 · Root as daily admin Every click is unbounded. MFA on root does not make root a person. ### 2 · “AWS was hacked” Usually a leaked key or a public bucket. Start with IAM and S3, not a region outage story. ### 3 · VPC as the only perimeter A private subnet does not stop a stolen access key from calling s3:GetObject on tc-lab-app-logs . ### 4 · IAM user keys for humans They live for years. Identity Center issues temporary credentials. Next lesson is the org; this lesson is the person. ## How to prove it Close the ticket only when 1) Caller identity is not root. 2) Root MFA is on and root keys are absent. 3) You can say of-cloud vs in-cloud for the sick service. 4) You did not “fix” it by creating another long-lived key. ## Traps Symptom Your side Wrong fix Someone listed all buckets IAM / leaked key “AWS breach, wait for AWS” EC2 CVE on the guest You patch the AMI / instance Open a hypervisor ticket S3 object public Bucket policy / ACL / BPA Blame S3 durability ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Who patches the guest OS on an EC2 in 10.51.0.0/16? AWS always You — that is in-the-cloud The TGW GuardDuty Correct: b . Shared responsibility: guest OS is customer. Q2 Root on 111122223333 should be used for… Daily console and CLI Rare break-glass after MFA, not a teammate login Application runtime S3 object GET Correct: b . Root is the account owner. Q3 A stolen IAM access key can read S3 even from a private subnet because… IAM is the API perimeter, not the VPC edge NACLs encrypt objects TGW blocks STS Root MFA covers every principal Correct: a . Identity vs network. Q4 Preferred human login to this dummy account? IAM user access keys in a spreadsheet IAM Identity Center (SSO) temporary credentials Root password in chat Hard-coded keys in user-data Correct: b . Identity Center for humans. Q5 First proof command on any AWS ticket? aws sts get-caller-identity reboot the instance disable CloudTrail open 0.0.0.0/0 on sg-web Correct: a . Who are you. Q6 S3 durability of the service is AWS. Public objects are… Also AWS’s fault automatically Your configuration — in the cloud A TGW route Fixed by adding a second root Correct: b . Bucket policy / BPA is customer. Check answers Reset AWS security class series: Shared + IAM · Org / OU · SG vs NACL · Role not key · KMS + Secrets · VPC endpoint · Trail + GuardDuty · TGW hub · S3 public · Interview ## Sources - AWS Shared Responsibility Model . - IAM User Guide — IAM roles . Related: AWS session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt