# Shared responsibility model

> Who secures what in the cloud: the provider, the customer, or both.

- Level: Intermediate
- Topics: Cloud, Security
- URL: https://tidbit.legios.com.ar/shared-responsibility-model/
- In Spanish: [Modelo de responsabilidad compartida](https://tidbit.legios.com.ar/es/shared-responsibility-model/)

When you run something in the cloud, keeping it safe is split between two parties. The **shared responsibility model** is the rule book for that split. The provider is responsible for the security of the cloud: the buildings, the hardware, the network and the software that runs its services. You are responsible for security in the cloud: your data, who can log in, and how you configure what you rent.

Where the line falls depends on the kind of service. With a virtual machine, the provider looks after the physical server and the virtualization layer, but you patch the operating system, set the firewall rules and manage the accounts. With a managed database, the provider also patches the database software. With a finished app like email, the provider handles almost everything, yet who has access and what data you put in it is still on you.

It matters because many cloud breaches are not the provider being hacked. They are customer mistakes: a storage bucket left public, a key with too much power, a database open to the whole internet. The provider gives you the locks, but you decide whether to lock the door. AWS, Microsoft Azure and Google Cloud each publish their own version of the model, and auditors often ask which side handles each control.

## An analogy

Renting an apartment: the landlord keeps the building standing, the front door working and the pipes sound. Whether you lock your own door, and who you give a copy of the key to, is up to you.

## Keep in mind

- The provider secures the cloud itself; you secure what you put in it.
- The more managed the service, the more the provider takes on.
- Your data, accounts and access settings are always your job.
- Many leaks come from customer misconfiguration, like a public bucket.

## Go deeper

- [Shared Responsibility Model (AWS)](https://aws.amazon.com/compliance/shared-responsibility-model/)
- [Shared responsibility in the cloud (Microsoft Azure)](https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility)
- [Shared responsibilities and shared fate (Google Cloud)](https://docs.cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate)

## Related terms

- [Cloud computing](https://tidbit.legios.com.ar/cloud-computing/): Renting computers over the internet instead of buying your own.
- [Virtual machine](https://tidbit.legios.com.ar/virtual-machine/): A complete computer made of software, running inside a real one.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Hypervisor](https://tidbit.legios.com.ar/hypervisor/): The software layer that splits one physical computer into many virtual machines.
- [Operating system](https://tidbit.legios.com.ar/operating-system/): The base software that runs a device and lets every app share its hardware.
- [Firewall](https://tidbit.legios.com.ar/firewall/): A gatekeeper that decides which network traffic gets in or out.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [Internet](https://tidbit.legios.com.ar/internet/): A worldwide network of networks that lets any connected device reach any other.