Shared Controls are controls which apply to both the infrastructure layer and customer
layers, but in completely separate contexts or perspectives. In a shared control, AWS
provides the requirements for the infrastructure and the customer must provide their own
control implementation within their use of AWS services. Examples include patch
management, configuration management, and awareness and training
Though patch management is a shared control, operating system patching specifically is
a customer responsibility
Protection of infrastructure is solely an AWS responsibility
Client and server-side data encryption are both customer responsibilities