Shared Responsibility Model in the Cloud

Overview

The Shared Responsibility Model in the cloud describes how responsibility for workloads is split between the cloud provider (CSP) and the customer. The model distinguishes responsibilities based on the operating model (IaaS, PaaS, SaaS):

• Infrastructure as a Service (IaaS)
  • The CSP is responsible for all infrastructure components.
  • The customer is responsible for everything else, i.e. operating system, middleware, applications, users & permissions, clients/endpoints and the data.
• Platform as a Service (PaaS)
  • The CSP is responsible for all infrastructure components as well as the operating system, middleware and partly the platform configuration.
  • The customer is responsible for the application, users & permissions, clients/endpoints and data.
• Software as a Service (SaaS):
  • The CSP is responsible for all infrastructure components, including running the application.
  • The customer is responsible for users & permissions, clients/endpoints and, of course, the application’s data.

Apart from that, customer and CSP also share responsibility for compliance and governance topics and are jointly obliged to meet legal requirements.

Provider-Specific Interpretation

The Shared Responsibility Model is cloud-agnostic in principle, but most providers have their own interpretation.

Here are a few highlights for AWS, Azure and GCP:

Amazon AWS

Amazon’s Shared Responsibility Model focuses primarily on security and compliance topics:

Security and Compliance is a shared responsibility between AWS and the customer. This shared model can help relieve the customer’s operational burden as AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates. The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall. […] As shown in the chart below, this differentiation of responsibility is commonly referred to as Security ‘of’ the Cloud versus Security ‘in’ the Cloud.

AWS Shared Responsibility Model

Microsoft Azure

The shared responsibility model for Microsoft’s Azure cloud paints an easy-to-understand picture, based on the “Pizza as a Service” analogy:

Azure Shared Responsibility Model

Google Cloud Platform

Google extends shared responsibilities with the concept of “shared fate”:

We developed shared fate in Google Cloud to start addressing the challenges that the shared responsibility model doesn’t address. Shared fate focuses on how all parties can better interact to continuously improve security. Shared fate builds on the shared responsibility model because it views the relationship between cloud provider and customer as an ongoing partnership to improve security.

Other than that, Google’s model looks like Microsoft’s:

GCP Shared Responsibility Model

Sources

• AWS: Shared responsibility model
• Azure: Shared responsibility in the cloud
• GCP: Shared responsibility & shared fate