Shared responsibility in practice: what your cloud provider leaves to you
Where is the line?
Every major provider publishes a version of the shared responsibility model. The wording differs, but the split is similar. The provider is responsible for the physical data centers, the hardware, the hypervisor and the managed services it operates. The customer is responsible for the settings of every resource it creates, the identities and permissions it grants, the data it stores, and anything it installs on machines it controls.
How does the line move with the service type?
- Virtual machines: you own the operating system, patches, installed software and network rules. Workload protection and vulnerability management matter most.
- Containers on a managed Kubernetes service: the provider runs the control plane; you own the images, the workloads and the cluster's permissions.
- Serverless functions: the provider runs the machines; you own the code, its packages and the role it runs as. There is nothing to install an agent on.
- Managed databases and storage: the provider runs the service; you own access settings, encryption choices and what data goes in.
The pattern: as you move to managed services, your share moves away from patching machines and toward configuration, identity and data. That is why posture (CSPM), entitlements (CIEM) and data posture (DSPM) grow in importance as estates modernize.
What does this mean for tool choice?
A team running mostly virtual machines needs strong workload protection and vulnerability management. A team built on serverless and managed services gets more from posture and identity checks. Most estates are a mix, which is one reason CNAPPs exist.
What is often missed?
Identity. A misconfigured role can expose data without any vulnerable software involved, and the provider will not flag it, because granting the permission was your decision. Logging is another: providers offer activity logs, but turning them on and keeping them is the customer's job.
What next?
Machine identities are the part of your share that grows fastest. The next lesson covers them.