¿Qué es el modelo de responsabilidad compartida de AWS?

Los proveedores de servicios en la nube, como AWS manage a significant portion of infrastructure security, but that does not mean customers are off the hook. The Amazon shared responsibility model defines exactly where provider responsibility ends and customer responsibility begins.

Este artículo explica los componentes principales del modelo de responsabilidad compartida y ofrece un desglose práctico de cómo varía la responsabilidad en función del tipo de servicio de AWS que se utilice.

Nota: Muchos de estos conceptos también son aplicables a otros proveedores de servicios en la nube.

The Amazon shared responsibility model separates responsibilities into two categories: security of the cloud and security in the cloud. AWS is responsible for the physical infrastructure, including data centers, servers, and networking. Customers manage what runs inside the cloud, including data, access controls, application settings, and encryption.

Con la infraestructura como servicio (IaaS), como Amazon EC2, los clientes se encargan del sistema operativo, la configuración del cortafuegos y la aplicación de parches de software. Por el contrario, con los servicios sin servidor o gestionados, como AWS Lambda o Amazon S3, AWS se encarga de la plataforma y del entorno de ejecución, mientras que los clientes siguen siendo responsables de los permisos de acceso y la integridad de los datos.

Para cumplir con su parte del modelo, los clientes deben contar con procesos claros para gestionar las configuraciones, aplicar parches y proteger las identidades. AWS puede proporcionar la infraestructura, pero los clientes son responsables de proteger lo que construyen sobre ella.

Una interpretación errónea del modelo de responsabilidad compartida puede dar lugar a brechas de seguridad en AWS. Cuando los equipos dan por sentado que AWS se encarga de más de lo que realmente hace, pueden omitirse tareas clave como el control de acceso o el cifrado de datos, lo que aumenta el riesgo de exposición o de problemas de cumplimiento normativo.

Asignar funciones claras ayuda a reducir la confusión y a evitar que se pasen por alto pasos importantes. Los equipos de seguridad deben definir quién se encarga de qué en las capas de red, configuración y aplicaciones. Esto incluye decidir quién establece las políticas de cortafuegos, quién gestiona la aplicación de parches y quién supervisa la actividad del sistema.

1. Inventory AWS services in use: Identify which services are used and categorize them by service type (IaaS, PaaS, SaaS), since responsibility shifts based on the model.

2. Map responsibilities clearly: Use AWS documentation to separate what AWS manages from what your teams need to handle.

3. Assign ownership by control: Document which team or person is responsible for each task, especially for customer-managed controls like encryption or access policies.

4. Automate configuration checks: Use tools such as AWS Config to monitor compliance with your internal security standards.

5. Audit permissions regularly: Review IAM policies to limit access based on job roles and remove unused credentials.

6. Architect for worst-case scenarios: Build with immutability, indelibility, and air gapping so that if a catastrophic event happens or bad actor gets in, the damage is minimized and there’s always a recovery point available.

Commvault enables this level of proactive isolation and immutability with:

• Easily configurable data copies in isolated accounts with Commvault AirGap.
• Air-gapped, cross-account backups by default with Commvault® Cloud Rewind and Clumio.

7. Test response processes: Run simulations to verify that detection and recovery actions work as expected and are assigned to the right teams.

Commvault can help automate the testing and validation of recovery processes with its industry-first Cleanroom™ Recovery solution or through the cross-region, cross-account recovery capabilities within Cloud Rewind and Clumio.

8. Update documentation regularly: As service usage changes, revise your shared responsibility model mappings to reflect current architecture and controls.

Esta tabla pone de relieve cómo la responsabilidad pasa de recaer en un único responsable a un modelo compartido. Malinterpretar estos cambios puede dar lugar a lagunas en la protección, especialmente en áreas como el control de acceso y el registro de auditoría. Saber qué equipo es responsable de cada control ayuda a reducir ese riesgo.

• Simplified management: Commvault integrates broadly across AWS services – as well as other on-premises and cloud technologies – to automate policy-based protection from a single pane of glass.
• Enhanced security: Commvault provides greater protection against ransomware and other cyberthreats with AI-forward threat scanning, as well as providing air-gapped, immutable, indelible backup copies for improved recoverability.
• Lower TCO: In addition to the cost benefits of helping to mitigate risk and reduce the impact of potential threats, Commvault also helps organizations control data protection-related cloud costs by optimizing how the data is collected and stored. With Commvault, organizations can keep fewer full snapshots and store data deduplicated and compressed without compromising recovery point objectives, realizing significant cost savings.

El Grupo Sony, el gigante mundial del entretenimiento y la electrónica, se enfrentaba a importantes retos a la hora de unificar la ciberresiliencia en su complejo entorno multicloud. Con amplias implementaciones de AWS y Azure, su equipo de Servicios de Centros de Datos necesitaba una solución que pudiera conectar sus cargas de trabajo locales, en la nube y SaaS, al tiempo que cumpliera con estrictos requisitos de seguridad.

“Our strategy is to connect globally from our data centers to our cloud solution,” explains Cassandra Cinar, senior director of Data Center Services at Sony. “To achieve that, we need a unified platform for recovery across cloud, on-premises, and software-as-a-service workloads.”
Sony’s security requirements were particularly demanding. The company needed a solution that could protect data across virtually all AWS users globally while supporting the company’s diverse multi-architecture environment. Additionally, the solution needed to help Sony comply with internal financial systems as well as SOC and GDPR requirements.

Tras evaluar múltiples opciones, Sony optó por Commvault Cloud por sus completas capacidades de ciberresiliencia. La implementación abarca ahora 5.000 terminales repartidos por múltiples centros de datos, regiones y proveedores de nube, incluida su amplia presencia en AWS.

Los resultados han sido notables. Sony redujo los costes de hardware, almacenamiento en soportes físicos y copias de seguridad en aproximadamente un 80 % gracias al cifrado, la compresión y la transición al almacenamiento en disco y en la nube en AWS y Azure. La empresa también mejoró sus objetivos de punto de recuperación y ganó la capacidad de detectar amenazas antes, recuperarse más rápido y reducir el tiempo de inactividad.

“The key differences among security solutions lie in their deployment and recovery capabilities,” Cinar said. “Commvault’s robust and comprehensive infrastructure satisfies all our needs for recovery, service-level agreements, and crucial functionalities like threat detection and other security features.”

Sony’s experience demonstrates how organizations can successfully navigate the AWS shared responsibility model by implementing a unified approach to data protection and security across hybrid environments. Their partnership with Commvault and Accenture allowed them to establish consistent protection policies across their entire AWS infrastructure while maintaining compliance with both internal and external requirements.

Commvault helps address customer responsibilities under the AWS shared responsibility model by providing enterprise-grade tools for data protection, recovery, and el cumplimiento normativo. Its platform supports hybrid and multi-cloud environments, so organizations can manage their data consistently across AWS and other infrastructure.

Commvault extends the responsibility of securing and protecting data in the cloud to mission-critical data center workloads through air-gapped, immutable backups stored within an isolated tenant in Amazon S3.

This enables organizations to provide this added layer of recoverability across the broadest ecosystem, including infrastructure and applications like SAP, Oracle, Microsoft SQL Server, Active Directory, Epic Systems, VMware, and ServiceNow, among others. Commvault protects these workloads, backing them up into AWS and providing additional layers of security and resilience to align with the shared responsibility model.

Simplifying with built-in automation, Commvault reduces manual steps in backup and recovery, helping teams respond faster and with fewer errors. Centralized visibility across workloads gives IT and security teams the ability to monitor data activity, verify controls, and stay aligned with industry regulations.

Commvault also enables organizations to provide faster recoveries at lower cost for emerging native workloads like Amazon S3 and Amazon DynamoDB with their Clumio solution, optimizing protection and making this critical protection more accessible. Organizations leveraging Clumio can meet their shared responsibility for protecting data within native AWS services with a simple, turnkey solution optimized for cost and efficiency.

Understanding the AWS shared responsibility model is critical for protecting your data and applications in the cloud. When you know exactly which security controls fall under your responsibility, you can build stronger defenses and respond faster to threats.
Commvault can help organizations close security gaps and strengthen their data protection strategy in AWS, so let us show you how our platform can support your cloud security goals by requesting a demo.