# Configuration and vulnerability analysis in CloudWatch Omni
<a name="omni-configuration-and-vulnerability-analysis-in-cloudwatch"></a>

Configuration and IT controls are a shared responsibility between AWS and you, our customer. For more information, see the AWS [shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/).

For the managed service, AWS handles basic security tasks such as guest operating system and database patching, firewall configuration, and disaster recovery. These procedures have been reviewed and certified by the appropriate third parties. For more details, see the following AWS resources:
+ [Shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/)
+ [Best practices for security, identity, and compliance](https://aws.amazon.com/architecture/security-identity-compliance/)

CloudWatch Omni also ships software that you install. The following components run in your environment, and keeping them current is your responsibility. For the extension itself, see [Develop with the IDE extension](omni-develop-with-the-ide-extension.md). For installing the collector, see [Send telemetry to CloudWatch Omni](omni-send-telemetry.md).


| Component | How it updates | Your responsibility | 
| --- | --- | --- | 
| The IDE extension | Updates itself through the extension gallery. | Keep automatic updates enabled, and apply updates. | 
| The local MCP server | Bundled inside the IDE extension and versioned with it. It has no separate patch cadence. | Update it by updating the extension. | 
| The local development server | Bundled with the IDE extension. | Update it by updating the extension. | 
| The AWS Distro for OpenTelemetry collector | You install it and you patch it. It is pinned in your own dependency manifests. | Track and apply upstream security updates yourself. | 

**Updates and vulnerability notification.** There is no separate security-bulletin or vulnerability-notification channel for these components. Keep extension updates enabled, and track upstream OpenTelemetry releases yourself to stay current on security fixes.

**The local MCP server and third-party AI assistants**

The local MCP server has no authentication. See [Infrastructure security in CloudWatch Omni](omni-infrastructure-security-in-cloudwatch-omni.md). Its tool set exposes trace search, dataset, evaluation, and credential operations. Because the tooling can connect this content to third-party AI coding assistants, review and control which assistants you allow to access your local trace and dataset content. See [Security best practices for CloudWatch Omni](omni-security-best-practices-for-cloudwatch-omni.md).