Key takeaway
Do not infer the responsibility boundary from a service label alone. Record which layers the provider operates and what you must configure or protect in identity, data and applications for each service.
Layers of cloud infrastructure
A cloud service runs on physical compute, storage and networking. Virtualization presents those resources as virtual machines and other services; management and orchestration provision, configure and scale them. Applications run above these layers, and users connect over the internet or private links.
Compute
Virtual machines, containers and serverless functions run applications.
Storage and data
Object, block and file storage serve different workloads; backups need a separate plan.
Networking and management
Virtual networks, policies and automation connect services and make changes repeatable.
Compare deployment models
A deployment model describes who the infrastructure is dedicated to and where it runs. It is separate from the service model: an organization can use different service models in public, private or combined environments.
Public cloud
A provider serves multiple customers on shared physical infrastructure with logical isolation. It offers managed capacity and scale, while configuration and identity controls remain essential.
Private cloud
The environment is dedicated to one organization and may be hosted on premises or by a provider. It can offer more control choices while increasing the organization’s operational and cost responsibilities.
Hybrid and multi-cloud
Hybrid connects private environments with public cloud; multi-cloud uses more than one provider. Both can add flexibility, but identity, logging, network and policy controls must work across environments.
IaaS, PaaS and SaaS: who manages what
A service model indicates which technical layers the provider operates and which remain under customer control. It is a guide; exact duties depend on the service and its configuration.
| Model | Provider generally manages | Customer generally manages | Typical use |
|---|---|---|---|
| IaaS | Physical equipment, hypervisor and virtual resource provisioning. | Guest OS, patching, network rules, applications, identity and data. | Running an existing application on a VM; flexible capacity for web hosting, testing and recovery environments. |
| PaaS | Infrastructure, operating system, runtime and managed platform components. | Application code, data, users and permissions, application configuration and release process. | Building APIs and apps with platform tools, managed runtimes and CI/CD; check OS control and portability needs up front. |
| SaaS | The application and the platform it runs on. | Accounts, access policies, data classification and sharing, devices and usage policies. | Using a ready-made email, collaboration or CRM application. |
Apply shared security responsibility
The provider generally secures its data centers and the foundational infrastructure that runs a service. Customers protect their data, accounts, access, applications and any operating systems they manage, according to the service configuration. PaaS and SaaS shift more technical work to the provider, but customers still govern data and access. Check the product documentation for exact duties.
Assign a service owner
Name a technical and business owner for each account, service and workload. Decide what evidence of provider controls you need and how you will verify your own controls.
Govern access and data
Grant least privilege, protect privileged accounts, review public sharing, and plan encryption and backups according to data sensitivity.
Review each service
In an IaaS example such as EC2, the customer manages the guest OS, application and network rules. In a managed service such as S3, the provider operates more of the platform while the customer configures data, permissions and sharing. These examples do not replace the service terms and configuration details.
A map of core AWS services
AWS combines compute, storage, database, identity and networking services. More than memorizing names, understand which resource a service operates and where configuration responsibility remains.
Amazon EC2
Virtual servers for applications. The customer manages the guest OS, software patches, applications and security groups.
Amazon S3
Object storage. The customer configures object permissions, bucket policies, data classification and suitable encryption options.
Amazon RDS
A managed relational database service. It can reduce some operational work; the customer still manages data, access, network placement and application connections.
AWS IAM and Amazon VPC
IAM governs identities and permissions; VPC provides a logically isolated network. Customers configure policies, routes and resource access.
Integration and communication platforms
Choose a platform service around the application’s task. Communication APIs and integration between systems serve different purposes.
CPaaS · Communication APIs
Adds voice, video and messaging to an application through APIs. The customer governs user access, data flows and application logic.
iPaaS · System integration
Connects cloud and on-premises applications, data and processes. Define integration-account permissions, transferred data and retry behavior when a flow fails.