Shared Responsibility Model

The shared responsibility model is the line a platform draws between the parts it operates and the parts you operate. The provider takes the layers underneath — the buildings, the machines, the hypervisor, and progressively more of the stack as the service becomes more managed — and you take everything above the line, which almost always includes who has access, how the thing is configured, and what happens to your data inside it. The important property of the line is that it moves. Rent a virtual machine and you are patching the operating system; rent a managed database and you are not; rent a finished application and you are left with accounts, permissions and content. Buyers get into trouble by carrying an assumption from one service to another, because the sentence the provider is responsible for security is true and useless without the second half of it. The characteristic failure is not a breach of the provider's half. It is a gap: both sides read the same page and each concluded the other had backups, or key rotation, or the audit trail, and nobody had it. That gap is invisible until an incident, and an incident is a bad time to discover it. The practical habit is unglamorous and works. For each service you depend on, write one line for who does patching, who does backup and restore, who holds encryption keys, who reviews access, and who is expected to notice a problem first. Where the answer is us, put a name on it. Where the answer is them, find the sentence in the contract that says so, because a marketing page describing the provider's half is not a commitment about yours. Doing this for a handful of services takes an afternoon, and it converts a diagram everybody nods at into a list somebody owns. The other thing worth writing down is when the line last moved. Migrating from a machine you patch to a managed equivalent quietly transfers half a page of work to the provider, and the reverse migration transfers it back without anyone reopening the document that says who does what.