Shared Responsibility
Matrix — IaaS · PaaS · SaaS
Interactive matrix showing exactly what you own vs what AWS, Azure, and GCP own — across IaaS, PaaS, and SaaS service models. Select a service model and provider to drill into specific responsibilities, common misunderstandings, and required customer controls.
Detail
"The cloud is secure by default"
Cloud providers secure their infrastructure — you are responsible for everything you deploy on top of it. Misconfigurations (public S3 buckets, open security groups) are entirely your responsibility.
"Provider encrypts my data automatically"
Providers may encrypt at rest by default, but they hold the keys. You need BYOK/CMK to prevent provider access. Key management is always a customer responsibility.
"SaaS = zero security responsibility"
In SaaS you still own: data governance, access controls, user provisioning/deprovisioning, DLP settings, conditional access, sharing permissions, and compliance classification.
"PaaS patches itself, no patching needed"
Providers patch the platform (OS, runtime). You patch the application code, libraries, and containers you deploy on PaaS. Application-layer CVEs remain your responsibility.
Network Security Groups / Firewalls
Providers supply the firewall tooling (SGs, NSGs, VPC Firewall Rules). Configuration of rules — what's allowed and denied — is entirely your responsibility. Default: often too permissive.
Identity & Access in PaaS
Provider manages the IAM service. You manage: user accounts, role assignments, permission boundaries, MFA enforcement, and conditional access policies. A compromised admin = provider infra can't help you.
🔍 Customer Responsibility Breakdown
Select a provider and service type. Get a concrete list of every control the customer owns, common gaps seen in incident response, and the specific cloud service/setting to configure.