Sign in Get started

Cloud Computing Tutorial · Cloud Basics · Lesson 3 of 24

The Shared Responsibility Model

What the cloud provider secures and what remains your job, for IaaS, PaaS and serverless.

Create a free account to save this page, take notes and track your progress. Sign in

Security "of" and "in" the cloud

The provider is responsible for security of the cloud: physical data centres, hardware, the network and the virtualisation layer. You are responsible for security in the cloud: your identities and permissions, data, network rules, operating system patches (for VMs), application code and configuration.

Responsibility VMs (IaaS) Managed database (PaaS) Serverless function
Physical security, hardware Provider Provider Provider
OS patching You Provider Provider
Database engine patching You Provider (in your maintenance window) n/a
Network rules (security groups) You You You (if in a VPC)
Identity and access (IAM) You You You
Data classification, encryption settings You You You
Application code and dependencies You You You

Most cloud breaches are on the customer's side: leaked access keys, public storage buckets, over-permissive roles and unpatched servers, not failures of the provider.

Who secures which layerTry it yourself
LAYERS = ["facilities", "hardware", "hypervisor", "os", "runtime", "app code", "identity", "data"]
PROVIDER_UP_TO = {"IaaS (VM)": "hypervisor", "PaaS (managed DB)": "runtime", "Serverless": "runtime"}

for model, last in PROVIDER_UP_TO.items():
    cut = LAYERS.index(last) + 1
    print(f"{model:18} provider: {', '.join(LAYERS[:cut])}")
    print(f"{'':18} you:      {', '.join(LAYERS[cut:])}")

Output

IaaS (VM)          provider: facilities, hardware, hypervisor
                   you:      os, runtime, app code, identity, data
PaaS (managed DB)  provider: facilities, hardware, hypervisor, os, runtime
                   you:      app code, identity, data
Serverless         provider: facilities, hardware, hypervisor, os, runtime
                   you:      app code, identity, data

Test yourself

A company's S3 bucket with customer data was publicly readable. Whose responsibility was that?

  1. AWS's
  2. The customer's
  3. Nobody's
  4. The internet provider's
Show answer

Answer: The customer's

Access configuration of your data is security in the cloud, the customer's side of the model.

Was this page helpful?