Once we begin consuming cloud resources, we need to be aware that we are operating our application on some kind of provider-managed infrastructure and that both parties have a different level of access to the environment.
The following diagram represents an overview of the shared responsibility model:
There are quite a few differences between the shared responsibilities depending on whether a customer is running an IaaS or a PaaS. For example, if the customer is using IaaS and running a virtual machine with a database instance on the cloud, the provider has access to and responsibility for securing the following:
- The underlying hardware in their data center
- The server and hypervisor where the VM instance is running
- The storage subsystem where the data volume is residing
- The physical network devices that connect the hypervisor to the internet ...