Intermediate · Cloud security basics · topic 28 of 43 · 30 min
The shared responsibility model
Explanation
Why this model matters
When a company moves to the cloud, people sometimes assume "Amazon (or Microsoft, or Google) handles security now". That is the most dangerous mistake in cloud security. The provider protects its own infrastructure extremely well. But if you leave your storage open to the public or give everyone admin rights, the provider will not stop you. AWS describes it as: the provider is responsible for security OF the cloud; the customer is responsible for security IN the cloud.
Service models
How much you manage depends on what kind of service you use:
- IaaS (Infrastructure as a Service): you rent virtual machines, networks and storage. Example: AWS EC2, Azure Virtual Machines, Google Compute Engine. You manage the operating system and everything above it.
- PaaS (Platform as a Service): the provider runs the operating system and platform; you deploy your code and data. Example: AWS Elastic Beanstalk, Azure App Service, managed databases.
- SaaS (Software as a Service): you use a finished app. Example: Microsoft 365, Google Workspace, Zoho, Salesforce. You still manage who has access and what data goes in.
| Layer | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Data and its classification | Customer | Customer | Customer | Customer |
| Identities and access settings | Customer | Customer | Customer | Customer |
| Application | Customer | Customer | Customer | Provider |
| Operating system and patching | Customer | Customer | Provider | Provider |
| Virtualisation (hypervisor) | Customer | Provider | Provider | Provider |
| Physical servers, network, buildings | Customer | Provider | Provider | Provider |
Notice the top two rows: data and identities are always the customer's job, whatever the model. Exact splits differ slightly between providers and services, so read the provider's own shared responsibility page for each service you use.
What customers commonly get wrong
- Storage buckets or blobs left open to the public internet.
- Admin accounts without MFA, and the root or owner account used for daily work.
- Long-lived access keys in code or laptops.
- Virtual machines never patched, because "it is the cloud".
- Logging not turned on, so there is nothing to investigate after a breach.
Where data lives (India)
Cloud providers let you choose regions. AWS, Microsoft Azure and Google Cloud all have regions in India (for example Mumbai and Hyderabad for AWS). Some Indian rules require certain data to stay in India; for example, the RBI's 2018 direction requires payment system data to be stored only in India. Choosing the region is the customer's responsibility.
Common mistakes
- Believing a compliance certificate of the provider (like ISO 27001) covers your own setup. It covers the provider's part only.
- Not knowing which services the company uses ("shadow IT"), so nobody secures them.
- Assuming SaaS needs no security work. Access, sharing settings and MFA are still yours.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
The shared responsibility model · 1/6
Moving to the cloud does not hand all security to the provider.
Prefer a video by a teacher? Find free videos on “cloud shared responsibility model explained IaaS PaaS SaaS” on YouTube ↗
In real life: A data leak with no hacking
Researchers around the world regularly find cloud storage buckets that are open to the public, exposing documents like ID card scans, invoices and medical reports. In many such cases in India and elsewhere, the cloud provider was not hacked at all: the customer set the storage to public, often "temporarily" for a test. This is the customer's side of the shared responsibility model.
Practice (0/3 done)
A company runs its website on a cloud virtual machine (IaaS). Who must patch the operating system?
Write responsible(model, layer) for the table in the lesson. model is "iaas", "paas" or "saas"; layer is one of "data", "identity", "application", "os", "hypervisor", "physical". Return "customer" or "provider".
List five cloud services you or your college or company use (for example Gmail, Microsoft 365, Google Drive, a website host, a UPI app back-end you know of). For each, say IaaS, PaaS or SaaS, and write two security tasks that remain YOUR responsibility.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Cloud identity and access managementCloud security basics · same module
- Common cloud misconfigurationsCloud security basics · same module
- Logging and monitoring in the cloudCloud security basics · same module
- The shared responsibility modelCloud Computing (AWS, Azure, Google Cloud) · What cloud computing is
- Public, private, hybrid and multi-cloudCloud Computing (AWS, Azure, Google Cloud) · What cloud computing is
- AWS vs Azure vs Google Cloud: the service mapCloud Computing (AWS, Azure, Google Cloud) · Google Cloud and comparing the clouds
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
In every cloud model, who is responsible for the customer's data and user access?
Answer: The customer
Data and identities are always on the customer side.
Microsoft 365 is an example of…
Answer: SaaS
It is finished software you use: SaaS.
Who secures the physical data centre buildings?
Answer: The cloud provider
Physical security is always the provider's part.
Most cloud data leaks are caused by…
Answer: Customer misconfigurations like public storage
Misconfiguration on the customer side is the most common cause.
Does the provider's ISO 27001 certificate cover your own cloud configuration?
Answer: No, it covers the provider's responsibilities only
Your configuration is your responsibility and needs its own controls.
In AWS's phrase, what is the customer responsible for?Related
Answer: Security IN the cloud
The provider handles security OF the cloud; the customer handles security IN the cloud.
Who empanels cloud service offerings for Indian government departments?Related
Answer: MeitY
The Ministry of Electronics and Information Technology (MeitY) runs the empanelment.
What is the closest Google Cloud equivalent of AWS Lambda?Related
Answer: Cloud Run functions
Cloud Run functions (formerly Cloud Functions) run single functions on events, like Lambda.
What is the main way to achieve data residency in India on AWS?Related
Answer: Choosing Indian regions and making sure backups, logs and replicas stay there too
Region choice gives residency; you must also stop copies leaving the country.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 3 more topics in “Cloud security basics” before its exam: Cloud identity and access management, Common cloud misconfigurations, Logging and monitoring in the cloud.
- Module 7 exam: Cloud security basics · 12 questions · 20 min, without help. 4 topics of this module still to finish first.
- Then the next module, Governance, risk and compliance. 43 topics left in the course before the final exam.