AWS’s model is security of the cloud versus security in the cloud. A managed database does not move your backup duty. An EC2 instance does not move the patch duty.
Edited by Emilio Santos. October 1, 2026. Updated October 24, 2026.
Who this is for
The finance lead comparing a cloud bill with a colo quote, and the operator who will be asked who patches the guest.
On this page
- The split
- The lines
- How Microsoft and Google describe the split
- How to use this checklist, step by step
- A worked example
- Common mistakes
- Before you sign off
- FAQ
Amazon Web Services states the shared-responsibility model in public. AWS is responsible for security of the cloud: the hardware, software, networking, and facilities that run AWS services. The customer is responsible for security in the cloud. AWS says that responsibility depends on which services you pick. For Amazon EC2, AWS says the customer manages the guest operating system, including updates and security patches, the application software the customer installs, and the security-group firewall on the instance.
The split
Read this before a repatriation argument or a board slide that says “AWS is certified, so we are covered.” A certification of the provider’s infrastructure is not a patch on your image, a backup of your bucket, or a rule on your security group. AWS also says customers should look at the services they chose, because the work changes with the service, and because laws and regulations still apply to the customer.
The lines
| Question | Write the owner |
|---|---|
| Who patches the guest OS on each EC2 image? | A person’s name, not “AWS” |
| Who sets the security group? | The team that can open a port |
| Who backs up data in a managed store, and who has tested a restore? | Still you, unless a contract names the provider’s backup product and you have a restore date |
| Who configures encryption and keys? | The person who can lose the key |
| Which of these would move if you left for a colo? | The guest, the app, the data, the firewall rules. The building would not. |
How Microsoft and Google describe the split
The lines above use AWS’s wording. Other providers publish their own, and they differ in useful ways.
Microsoft Azure. Microsoft’s shared responsibility page lays out a table by deployment type: software as a service, platform as a service, infrastructure as a service, and on-premises. Physical hosts, network, and datacenter sit with Microsoft for the cloud models. The page also lists responsibilities the customer always retains, regardless of deployment type: data, endpoints, accounts, and access management. That list is a good summary for a board slide. No matter how managed the service is, your data, your devices, and your identities are yours.
Google Cloud. Google describes shared responsibility together with what it calls “shared fate,” where it aims to give customers secure defaults, blueprints, and guidance to help them meet their side. That is a statement of intent and tooling. It does not move your responsibilities to Google.
How to use this checklist, step by step
- List your top services. Start with the services that make up most of the bill or hold the most sensitive data.
- Classify each one. Infrastructure (virtual machines), platform (managed databases, containers), or software as a service. Your share of the work shrinks as you move up, but it never reaches zero.
- Write an owner for each line. Patching, network rules, backups, keys, identities. A person’s name, not a team alias.
- Check evidence. A patch report, a recent restore, a key rotation log. If there is no evidence, the line is a gap.
- Revisit before any move. Before repatriation or a provider switch, mark which lines change hands. The cloud repatriation note has the cost side.
A worked example
Illustrative case. A company runs its customer app on virtual machines, a managed database, and object storage. On the VMs, the company patches the operating system and the app, and sets the firewall rules. On the managed database, the provider patches the engine, but the company sets who can connect, turns on encryption options, and tests restores. On object storage, the company sets access policies. A misconfigured public bucket is the customer’s mistake under every provider’s model. If the company moved to a colo, it would also take on the hardware, the facility, and the physical network.
Common mistakes
- Assuming the provider’s compliance certifications cover your configuration. They cover the provider’s side.
- Assuming managed services are backed up the way you need. Check retention and test a restore.
- Forgetting identities. Most cloud incidents start with an account, not a broken data center.
Before you sign off
- Each major service is classified as infrastructure, platform, or software as a service.
- Each line on the checklist has a person’s name.
- You have evidence for patching, backups, keys, and access rules, not only a policy.
- You have read the split for every provider you use, in that provider’s own words.
- Any planned move shows which lines would change hands.
FAQ
Does this page cover Azure or Google Cloud?
The wording here is AWS’s, because that is the page linked below. Other providers publish their own split. Do not paste the AWS sentence onto another logo. Open that provider’s page and redo the table.
Is the provider responsible for nothing in the guest?
AWS’s page draws the line at the host and the facility for EC2, and at the customer for the guest and the security group. Managed services move some of the platform work. They do not move your data-retention choices. Read the service you actually bought.
Backup tools we would use
Disclosure: links marked “Paid link” may earn Circuit & Capital a commission at no cost to you.
The backup line stays yours in SaaS too. For Microsoft 365 or Google Workspace, IDrive Cloud Applications Backup is $20 per seat per year on IDrive’s page (checked November 10, 2026). Paid link: we may earn a commission. Microsoft 365 Backup, Microsoft’s own service at $0.15 per GiB per month, is the non-affiliate alternative. If your backup software writes to S3-compatible storage, IDrive e2 is one option. Paid link: we may earn a commission. Full comparison: password managers and backup tools for small teams.
Sources
- AWS, Shared Responsibility Model
- Microsoft Learn, Shared responsibility in the cloud: responsibilities the customer always retains: data, endpoints, accounts, access management
- Google Cloud Architecture Framework, shared responsibility and shared fate
Top comments (0)