☁️ Shared Responsibility
Cloud Shared Responsibility Matrix
Select your service type and cloud provider to see exactly what the cloud covers vs what you must secure — across all security domains.
Service Model
Cloud Provider
ProviderCloud provider's responsibility
CustomerYour responsibility
SharedBoth parties have responsibility
N/ANot applicable for this model
| Security Domain | Provider | What the provider covers | What YOU must do |
|---|
⚠️ Most Commonly Misunderstood Responsibilities
→
Data encryption at rest: Cloud providers offer encryption tooling — but enabling it and key management is the customer's job. A provider encrypts storage by default, but if you store unencrypted data and they encrypt the volume, your data is still exposed to anyone with your credentials.
→
IAM and access control: 100% customer responsibility on all providers in all models. The cloud provider secures its own control plane — but who can access YOUR resources is entirely your job. This is the most exploited gap.
→
OS patching (IaaS): For IaaS (EC2, Azure VMs, GCP Compute): the provider patches the underlying hypervisor. The OS inside the VM — Windows, Ubuntu — is YOUR responsibility. Unpatched OS = unpatched vulnerability in your environment.
→
Network security groups / NSGs: The networking infrastructure is the provider's. But which traffic you allow in/out via security groups, NACLs, or NSGs is entirely your job. An open port 22 to 0.0.0.0/0 is 100% customer mistake.
→
Application security: At no point does any cloud provider take responsibility for vulnerabilities in your application code — SQL injection, SSRF, authentication bugs. These are always customer responsibility regardless of service model.
→
Backup and recovery: Providers offer backup tooling (AWS Backup, Azure Backup, GCP Snapshots). Enabling, configuring, testing, and verifying backups is the customer's responsibility. "The provider handles backups" is a dangerous misconception.
→
Logging and monitoring: Providers offer logging services (CloudTrail, Azure Monitor, Cloud Audit Logs). Enabling them, retaining logs, and monitoring for threats is the customer's job. Disabled logging = provider responsibility, but blind to threats.