What is Shared responsibility model?

The cloud provider secures the cloud itself, and you secure what you put in it.

In plain English

Cloud providers describe security as split in two. The provider is responsible for the underlying facilities, hardware and core services. The customer is responsible for their own data, who can access it, and how their services are configured. The split moves depending on the service model: the more the provider manages for you, the less you have to secure yourself, but you are never fully free of responsibility.

Example

If a storage bucket is accidentally set to public and its contents leak, that is normally the customer’s responsibility, not the provider’s. AWS summarises the idea as security of the cloud versus security in the cloud.

Easy to confuse with

• IaaS, PaaS and SaaS: IaaS, PaaS and SaaS describe how much the provider runs. The shared responsibility model describes who owns security for each part.

Where you will meet it

This idea belongs to the subject area of these practice tests. We do not publish or predict real exam questions.

• AWS AIF-C01 practice tests
• AWS AIP-C01 practice tests
• ISC2 CC practice tests
• CompTIA Tech+ practice tests

Related terms

• IaaS, PaaS and SaaS: Three ways to rent cloud computing, from raw servers (IaaS) to a platform for your code (PaaS) to a finished app (SaaS).
• Least privilege: Give every person and system only the access they need to do their job, and nothing more.

Written and checked by the Be Ready Education team, last reviewed 2 November 2026. General study information, not professional advice. Providers change names and rules, so confirm details on the official documentation. Not affiliated with, endorsed by or sponsored by any certification vendor or exam body. Certification names, exam codes and product names are trademarks of their respective owners and are used only to identify the exam a practice product prepares for. Our questions are original and are not actual exam questions.