Clarify Responsibilities Before Using a Cloud Service

Start with the specific service

Cloud responsibilities depend on the service and the way it is used. Name the proposed service, workload and operating arrangement before assigning tasks. The responsibilities for a managed service may differ from those for a virtual machine.

AWS describes a shared responsibility model between the provider and customer. This guide uses that model as context, rather than presenting one universal division that applies unchanged to every cloud provider or service.

List the operational tasks

For the fictional exercise, a team is considering hosting a small training application. It should identify the tasks around application updates, access, data handling, configuration, monitoring and recovery. Assign an owner for each relevant task.

Use the provider’s documentation for the actual service to establish what the provider manages. Record what remains with the customer or an agreed support partner. Do not mark a task as covered merely because a product is marketed as managed.

Review permissions and recovery

Identify who can change access or configuration and how those permissions are reviewed. Explain who will notice a problem and who can act. Check the intended recovery arrangements rather than treating the existence of a storage service as a recovery plan.

Use fictional accounts and information in practice copies. Do not include credentials or operational secrets in a public workbook. For a real workload, involve the people responsible for security, support and the application.

Record questions before implementation

Finish with a responsibility list, unresolved questions and the source used to answer them. Confirm the owner and review point before proceeding. A responsibility discussion should lead to specific actions rather than a general assurance that the cloud is secure.

Practice task: choose a fictional application and list five operational tasks. For each, identify the proposed owner and the documentation needed to confirm the arrangement. Use the official service guidance for further detail; this introduction does not approve an architecture.

Source and practice note

AWS Security Pillar guidance explains that the division of responsibilities depends on the service used. Examples and exercises are original RDE material using fictional situations.

Read the official guidance

Cover image: AI-generated illustrative scene created specifically for this resource.