Shared Responsibility Model in Cloud Computing: AWS, Azure & GCP

The Shared Responsibility Model explains that cloud security is a joint responsibility between the Cloud Service Provider (CSP) and the customer.

The CSP is responsible for securing cloud infrastructure, including physical data centers, hardware, and core cloud services. The customer is responsible for protecting the data, applications, and configurations running inside that infrastructure.

Whether an organization uses AWS, Azure, or GCP, the responsibility for data ownership, user accounts, and access management always remains with the customer.

Understanding this model helps businesses manage cloud security properly and avoid common security gaps.

Cloud professionals can enhance their understanding of AWS security and architecture through the upGrad KnowledgeHut AWS Solutions Architect Certification Training, which covers key concepts required for building secure cloud solutions.

What Is the Shared Responsibility Model in Cloud Computing

The Shared Responsibility Model in cloud computing is a security and compliance framework that divides accountability between the cloud provider and the customer.

The provider is responsible for the security of the cloud, meaning physical data centers, host infrastructure, networking hardware, and virtualization layers.

The customer is responsible for security in the cloud, meaning data classification, identity and access management, operating system patching (where applicable), and application-level configurations.

This division is not optional or negotiable. It is built into the architecture of every major cloud platform and forms the legal and technical baseline for compliance frameworks such as ISO 27001, SOC 2, HIPAA, and GDPR.

How the Shared Responsibility Model Changes Across Cloud Services

The shared responsibility model changes depending on the type of cloud service being used.

The level of management and security responsibility depends on whether an organization uses Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS).

Infrastructure as a Service (IaaS)

Examples:

• Amazon EC2
• Azure Virtual Machines
• Google Compute Engine

In IaaS, cloud providers are responsible for securing the physical infrastructure, including servers, storage, and networking. Organizations are responsible for managing:

• Operating systems
• Security patches
• Applications
• Firewalls
• User access
• Data security

IaaS provides the highest level of flexibility, but it also requires organizations to handle more security and management tasks.

Platform as a Service (PaaS)

Examples:

• Azure App Service
• AWS Elastic Beanstalk
• Google App Engine

In PaaS environments, cloud providers manage the infrastructure, operating system, and runtime environment. This reduces the amount of technical management required from organizations.

Organizations remain responsible for:

• Application code
• Data protection
• Identity management
• Access controls

PaaS allows development teams to focus more on creating applications instead of managing servers and infrastructure.

Software as a Service (SaaS)

Examples:

• Microsoft 365
• Salesforce
• Google Workspace

In SaaS, cloud providers handle most infrastructure and application maintenance tasks, including updates, availability, and system management.

Organizations are still responsible for:

• User accounts
• Password policies
• Data governance
• Permission management
• Regulatory compliance

A common misunderstanding is that SaaS removes all security responsibilities. However, organizations still need to manage access, protect data, and follow security and compliance requirements.

Microsoft Azure Shared Responsibility

The Azure framework follows the same concept, dividing tasks across the Microsoft cloud ecosystem.

Microsoft Is Responsible For:

• Physical buildings and data centers
• Host computer operating systems
• Core network infrastructure
• Hypervisor security (the software that splits physical servers into virtual ones)
• General data center operations

Customers Are Responsible For:

• Microsoft Entra ID permissions (formerly known as Azure Active Directory)
• Software and workload setups
• Data security and encryption
• User device protection (endpoints)
• Application code
• General identity management

Example:

For Azure Virtual Machines, customers must install security patches, manage antivirus software, configure firewall rules (Network Security Groups), and control administrator access.

For fully managed services such as Azure SQL Database, Microsoft handles the underlying infrastructure, operating systems, and database platform maintenance.

Customers remain responsible for managing data access, permissions, encryption settings, and compliance requirements.

Popular Azure Security Tools:

Microsoft Defender for Cloud: Continuously monitors security posture, identifies vulnerabilities, and protects cloud workloads across Azure environments.

Microsoft Sentinel: A cloud-native security information and event management (SIEM) platform that helps organizations detect, investigate, and respond to cyber threats.

Azure Key Vault: Securely stores secrets, certificates, encryption keys, passwords, and API credentials while reducing the risk of unauthorized access.

Azure Policy: Enables organizations to enforce security standards, governance controls, and compliance requirements across Azure resources.

Microsoft Entra ID: Manages user identities, authentication, and access controls through capabilities such as Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Role-Based Access Control (RBAC).

Build advanced Azure architecture skills with the upGrad KnowledgeHut Azure Solutions Architect Certification Training and learn how to create secure and enterprise-ready cloud solutions.

AWS Shared Responsibility Model Explained

The AWS Shared Responsibility Model divides security tasks into two separate categories to ensure nothing is missed.

Security of the Cloud (AWS Responsibility)

AWS takes care of the physical and foundational parts of the system. This includes:

• Physical data centers and buildings
• Computer hardware and servers
• Global network infrastructure
• Regions and availability zones
• Core cloud systems that run managed services

Security in the Cloud (Customer Responsibility)

The organization using AWS is responsible for protecting whatever it puts inside the cloud. This includes:

• User accounts, passwords, and permissions (IAM)
• Operating systems on virtual servers (like EC2 instances)
• Application security and code
• Data encryption both at rest and during transfer
• Firewall rules and network security groups
• Backup and recovery plans

Example:

If a company accidentally sets a cloud storage folder (an S3 bucket) to "public" and confidential files are leaked, AWS is not responsible for the data breach. The customer controls all access settings and data visibility.

Key AWS Security Tools

Companies often strengthen their cloud safety using built-in tools like:

• AWS Identity and Access Management (IAM): Controls who can log in and what they can access.
• AWS Security Hub: Checks security settings across the entire cloud account in one place.
• AWS GuardDuty: Watches for strange or dangerous activity automatically.
• AWS Shield: Protects websites from massive cyberattacks that try to crash them.
• AWS Key Management Service (KMS): Creates and controls the keys used to lock and encrypt data.

Understanding this shared model helps businesses avoid simple setup mistakes, which cause most cloud security incidents.

How GCP Approaches the Shared Responsibility Model

Google Cloud Platform (GCP) follows the shared responsibility model with a strong focus on security built into its cloud services.

Google manages the security of cloud infrastructure, while organizations are responsible for protecting their data, applications, and access controls.

Google Cloud Responsibilities

Google is responsible for securing:

• Physical data centers
• Global networking infrastructure
• Hardware systems
• Core cloud services
• Virtualization technology

Google manages the security and reliability of the underlying cloud platform to provide a secure environment for businesses.

Customer Responsibilities

Organizations are responsible for managing:

• User access and permissions
• Data classification
• Application security
• Encryption settings
• Workload protection
• Compliance requirements

Although GCP managed services reduce the need for manual infrastructure management, organizations still remain responsible for controlling data access and maintaining proper security practices.

Popular GCP Security Tools

Many businesses use GCP security tools to improve protection and monitoring, including:

• Google Cloud IAM
• Security Command Center
• Cloud Armor
• Cloud Key Management Service
• Chronicle Security Operations

Even with highly managed cloud services, organizations must continue to manage user identities, permissions, and sensitive data to maintain a secure cloud environment.

AWS vs Azure vs GCP Shared Responsibility Model

Although terminology differs slightly, the overall concept remains consistent.

Responsibility	AWS	Azure	GCP
Physical security	Provider	Provider	Provider
Networking	Provider	Provider	Provider
Hypervisor	Provider	Provider	Provider
IAM configuration	Customer	Customer	Customer
Data encryption	Customer	Customer	Customer
Application security	Customer	Customer	Customer
Compliance configuration	Customer	Customer	Customer
Backup strategy	Customer	Customer	Customer

Regardless of platform, customers always own the security of their applications and data.

Building secure cloud environments requires knowledge of cloud architecture and best practices. The upGrad KnowledgeHut Cloud Computing Courses help professionals develop essential skills for designing and managing cloud solutions.

What Are the Most Common Shared Responsibility Model Mistakes?

Here are the most common mistakes organizations make.

1. Thinking the Cloud Provider Handles All Security

One of the biggest mistakes is believing that AWS, Azure, or GCP takes care of everything related to security.

In reality, cloud providers protect the infrastructure, but customers must secure:

• Data
• User accounts
• Access permissions
• Applications
• Cloud configurations

When businesses overlook these responsibilities, they increase the risk of security breaches and compliance issues.

2. Leaving Storage Open to the Public

Incorrectly configured storage services are a common cause of cloud data leaks.

Examples include:

• Public AWS S3 buckets
• Open Azure Blob Storage containers
• Misconfigured Google Cloud Storage buckets

A small mistake in permissions can expose sensitive business or customer data to anyone online.

3. Poor Identity and Access Management (IAM)

Many organizations give users more access than they actually need.

Common mistakes include:

• Too many admin privileges
• Shared user accounts
• Weak passwords
• Not enabling Multi-Factor Authentication (MFA)
• Keeping unused accounts active

Following the principle of least privilege helps reduce security risks.

4. Not Updating Software and Operating Systems

In cloud virtual machine environments, customers are responsible for keeping systems updated.

Failing to update:

• Operating systems
• Web servers
• Databases
• Applications

can leave known security vulnerabilities open to attackers.

5. Not Using Data Encryption

Cloud providers offer strong encryption tools, but customers usually need to enable and manage them.

Common issues include:

• Unencrypted databases
• Poor key management
• Unprotected backups

Encrypting data both at rest and in transit adds an important layer of protection.

6. Not Monitoring Cloud Resources

Many businesses set up cloud services but do not monitor them regularly.

Without proper monitoring, organizations can miss:

• Suspicious login attempts
• Unauthorized access
• Configuration changes
• Malware activity

Cloud security requires continuous monitoring, not a one-time setup.

7. Assuming Compliance Is Automatic

Just because a cloud provider meets standards like GDPR, HIPAA, or PCI DSS does not mean your organization is automatically compliant.

Customers are still responsible for:

• Managing access controls
• Protecting sensitive data
• Following regulatory requirements
• Maintaining audit records

Ignoring these responsibilities can lead to failed audits and fines.

8. Not Having Backup and Recovery Plans

Some businesses assume the cloud provider automatically backs up everything.

However, customers are often responsible for:

• Creating backup policies
• Setting retention periods
• Testing recovery procedures
• Building disaster recovery plans

Without proper backups, recovering from data loss can be difficult and costly.

9. Ignoring Employee Security Training

People are often the weakest link in security.

Without training, employees may:

• Share passwords
• Fall for phishing emails
• Misconfigure cloud resources
• Give unnecessary access to users

Regular security awareness training helps prevent these mistakes.

10. Not Reviewing Configurations Regularly

Cloud environments change quickly as new users, applications, and services are added.

If configurations are not reviewed regularly, businesses may end up with:

• Excessive permissions
• Outdated security rules
• Unused accounts
• Publicly exposed resources

Regular security reviews help identify problems before they become serious threats.

How Businesses Can Strengthen Their Shared Responsibility Model Strategy

Understanding responsibilities is only the first step. Organizations also need proper governance and security controls in place to act on that understanding.

1. Establish Strong Identity Management

Identity is often the weakest link in cloud security, so it deserves the most attention. Strong identity management includes:

• Multifactor authentication (MFA)
• Role based access control (RBAC)
• Least privilege access principles

2. Continuously Monitor Configurations

Misconfigurations remain one of the leading causes of cloud security incidents, and most of them go unnoticed until something breaks. Regular monitoring should cover:

• Storage permissions
• Network settings
• Security groups
• Public exposure risks

3. Encrypt Sensitive Data

Data should stay protected no matter where it sits or where it travels:

• At rest
• In transit

Encryption alone is not enough. It works best when paired with proper key management practices.

4. Conduct Routine Security Assessments

Security is not a one time setup; it needs regular checkups. Routine audits help catch:

• Compliance gaps
• Human errors
• Security vulnerabilities
• Excessive permissions

5. Implement Cloud Security Automation

Manual security checks cannot keep pace with how fast cloud environments change. Automation allows faster detection and quicker remediation of risks across AWS, Azure, and GCP environments, closing the gap between when a risk appears and when someone actually notices it.

Conclusion

The Shared Responsibility Model is the foundation of cloud security, where both the Cloud Service Provider (CSP) and the customer play important roles. Cloud providers secure the underlying infrastructure, while organizations are responsible for protecting their data, applications, identities, and configurations.

Whether using AWS, Azure, or GCP, understanding these responsibilities helps prevent security gaps and compliance issues. By implementing strong access controls, regular monitoring, encryption, and security best practices, businesses can create a safer and more reliable cloud environment.

Contact our upGrad KnowledgeHut experts and get personalized guidance on choosing the right course, career path, and certification for your goals.