Explain the AWS shared responsibility model. How does the split change between EC2, RDS and Lambda?

AWS secures the cloud itself. You secure what you put in the cloud. People say AWS owns security of the cloud, and you own security in the cloud.

AWS is responsible for:

• the data centers
• the hardware
• the network
• the virtualization layer (the software that splits one physical machine into many virtual ones)

You are responsible for:

• your data
• IAM permissions (IAM is AWS Identity and Access Management: who can do what)
• network rules
• encryption choices
• your application code

The line moves with the level of service:

• EC2 (virtual servers): you own the guest operating system, its patches, the runtime and everything you install on it.
• RDS (managed databases): AWS patches the OS and the database engine, and AWS runs backups. You still own database users, network access, encryption settings and your schema.
• Lambda (functions that run on events): AWS manages the OS and the runtime. You own the function code, its dependencies and the permissions in its execution role. The execution role is the IAM role the function runs as.

In every case, a wrong IAM setting or a public bucket is your problem, not AWS's.