Apply the Cloud Shared-Responsibility Model

Introduction

Cloud providers secure the facilities and platform components they operate, but customers still make many decisions that determine whether a workload is safe. The boundary changes between IaaS, PaaS and SaaS. A responsibility matrix converts a general model into concrete owners and evidence for one service.

How the topic works

In IaaS, the customer commonly manages operating-system updates and more of the network and application stack. PaaS shifts platform maintenance to the provider, while the customer still controls application code, identities, data and configuration. SaaS shifts more operations, but user access, data sharing, retention choices and secure usage remain customer duties.

Practical workflow

1. List assets, identities, data flows and required controls for the workload.
2. Read the provider’s current service documentation and contractual scope.
3. Assign provider, customer or shared ownership to each control.
4. Name the customer role that implements and reviews every customer control.
5. Attach evidence such as configuration exports, review dates or tested restore records.

Tools and technologies

• A responsibility assignment matrix
• Provider service documentation
• A control evidence register

Example

For a managed web application platform, the provider patches the underlying host. The customer still updates application dependencies, protects deployment credentials, configures network exposure, validates input, backs up data and tests recovery.

Common mistakes

• Assuming “managed” means fully secured
• Assigning a control to “IT” without a named role
• Copying a generic matrix without checking the selected service

Security and best practice

Revisit the matrix when the architecture, tier, region or provider terms change. Apply least privilege and verify recovery rather than treating documentation as proof. Schedule a named review after material changes.

Portfolio task

Key takeaways

• The boundary changes by service model.
• Customer configuration remains a major control surface.
• Evidence turns responsibility into an operational practice.

Curriculum connection

• Day 181: Risk and threat modeling
• Day 187: Network security controls
• Explore the complete No-Code learning path