Defining bucket policies and access control lists (ACLs) for Amazon S3 is a shared responsibility between AWS and the customer. AWS is responsible for managing the underlying storage infrastructure and ensuring physical security, while the customer is responsible for implementing data encryption at rest (if desired).