The service model determines responsibility
In AWS’s model, the provider protects the infrastructure supporting the cloud, while customer duties vary by service. With EC2, the customer typically manages guest OS and application updates. With an abstracted service such as S3, the customer still manages data and access permissions.
Moving to the cloud is not security acceptance. Create a responsibility table for services, data classification, identity, permissions, logs and recovery, then compare it with current provider documentation. Product and contract details are not interchangeable.
Further reading: AWS: Shared Responsibility Model
Connect ownership to configuration and verification
If a customer makes private objects public, physical security at the data center cannot correct that access setting. Review principal, action, resource and conditions, including anonymous access and cross-account sharing.
Encryption, backups, logging and recovery have distinct acceptance checks. Encryption does not establish least privilege, and a stored backup does not establish successful restoration. Assign each duty to a role and record validation.
Example: public website assets and private data
A fictional project stores public images and private raw research data in one storage area, then enables public reading for the whole area to display images.
Only images need publication, but the permission extends to private data. Separate public resources or precisely constrain the policy, then verify that anonymous users cannot retrieve private objects.
Conclusion: Infrastructure responsibility does not automatically correct the customer’s publication decision.
Tabletop exercise: a responsibility table
Analyze fictional services without signing in or changing policies.
- List physical hardware, guest-OS updates, object-publication permissions and data classification.
- Assign provider or customer duties using this lesson’s AWS example.
- Add a check that anonymous reads of a private object must be denied.
Expected result
The provider handles hardware; guest updates, customer data classification and customer object permissions still need customer management.
Check your work
Which duties need documentation review when moving to a different managed product?
Finish and clean up
Keep the table; no cloud resources or costs were changed.