The Cloud Shared Responsibility Model
On this page
In the cloud, security is a partnership: the provider secures the infrastructure, and you secure what you put on it. The shared responsibility model draws that line — and misunderstanding it is behind a large share of cloud breaches. The provider’s data centers are rarely the weak point; the customer’s misconfigured bucket, loose access control, or exposed key usually is.
Who owns what?#
The split shifts with the service model, but the pattern holds:
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Data & access | Customer | Customer | Customer |
| Application | Customer | Customer | Provider |
| OS / runtime | Customer | Provider | Provider |
| Physical / hardware | Provider | Provider | Provider |
The constant across all models: your data, your access controls, and your configuration are always your responsibility. The provider gives you secure building blocks; how you assemble them is on you.
Where the breaches happen#
The dangerous assumption is “the cloud is secure, so we’re secure.” The provider’s share is usually solid; the customer’s share is where things go wrong — a public storage bucket, an over-privileged IAM role, a database open to the internet. These are all misconfiguration, squarely on the customer side of the line.
The shared responsibility model is the foundation of cloud security. More at the Defense & Hardening hub.
Frequently asked questions#
What is the shared responsibility model?
The shared responsibility model defines how security duties are split between a cloud provider and its customer. The provider secures the underlying infrastructure — data centers, hardware, and the platform — while the customer secures what they put on it: their data, configurations, access controls, and applications. Who owns what shifts with the service type.
Why do so many cloud breaches happen on the customer side?
Because customers often assume "the cloud is secure" and neglect their share — leaving storage buckets public, access controls loose, or credentials exposed. The provider’s infrastructure is rarely the weak point; misconfiguration of customer-owned settings is. The shared model means the provider’s security cannot cover your mistakes.