The AWS shared responsibility model defines the division of security responsibilities between AWS and the customer. AWS is responsible for the security OF the cloud, covering physical infrastructure, hardware, regions, and the services themselves. The customer is responsible for security IN the cloud, which includes protecting data, configuring IAM, patching operating systems on EC2, configuring network firewalls, and managing encryption. The exact division depends on the service: with EC2 the customer patches the guest OS, but with fully managed services such as S3 or DynamoDB, AWS handles the operating system and infrastructure while the customer still owns data, access policies, and encryption settings.
To evaluate whether architectures follow best practices, AWS provides the Well-Architected Framework. It is built on five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization, with Sustainability later added as a sixth. Workloads reviewed against this framework identify risks and improvements.
The AWS Well-Architected Tool is a free console service that helps apply the framework to your own workloads, track identified risks, and benchmark against industry standards. Combined with awareness of the shared responsibility model, these two resources form the baseline for any developer working on AWS, ensuring that operational and security responsibilities are correctly assigned regardless of which services are used.