Shared responsibility model for container services

The second model we will cover is the container model. The word container is frequently used to describe software packages that contain code, and all associated dependencies that can be run across a range of different compute environments. Examples of common container technologies include Docker and Kubernetes. However, the word container when used here refers to a slightly different concept.

This model focuses on services that essentially reside on top of infrastructure services, meaning the customer does not have access to some of the infrastructure-level components—for example, the operating system. Examples of services in the container model include the following:

• AWS Elastic MapReduce (EMR)
• AWS Relational Database Service (RDS)
• AWS Elastic Beanstalk

This diagram shows the responsibility model for container services:

As you can see, AWS still maintains the same level of security responsibility as retained from the infrastructure model, plus more additional responsibilities. Platform and application management and operating system and network configuration are now the responsibility of AWS.

Let's take the example of RDS. In this case, we as customers do not have access to the underlying operating system that the RDS databases are running on; as such, customers are not able to patch the operating system. This security element has been abstracted away from the customer and transferred over to AWS. In addition, platform and application management has also been passed to AWS. This is because RDS is a managed service, and as a result, all the maintenance of the application itself is undertaken by AWS. This takes a huge administrative burden off the customer, but also introduces a level of restriction at the same time, as we are only presented with the platform and everything above that stack.

As this is a managed service, AWS will have to maintain access control over the underlying operating system to perform any maintenance at the operating system level. Again, as customers, we do not have access to these elements.

You may also notice that from the customer's point of view, we have a level of IAM permissions to maintain; this is for users who require access to use the service in question, such as RDS.