Direct answer
Shared responsibility depends on the specific cloud service: the provider and customer operate different layers, while customers retain responsibilities for their own identities, data and configuration. Map the actual deployment rather than applying one generic diagram.
Choose the exact service and workload
List the provider, service, region, account, workload owner and data handled. A managed database and a virtual machine can expose different configuration and patching responsibilities even within the same provider.
Reference: AWS shared responsibility model.
Assign control ownership
Create a table of identity, network exposure, encryption, logging, backup, application patching and incident response. For each control, record whether the provider, customer or another party operates it and which configuration choices remain with the customer.
- Include third-party integrations and managed-service contracts.
- Record evidence or documentation supporting each assignment.
- Mark unclear responsibilities as actions for the owner.
Test the customer-controlled boundary
For a managed database, verify customer-controlled network access and identities against the intended design using authorized test principals. Do not try to assess the provider's underlying systems outside the engagement scope or provider rules.
Keep the mapping current
Review the matrix when services, regions, deployment models or contracts change. Assign owners to missing controls and use the matrix to decide which evidence can be tested directly and which must come from provider documentation or attestations.
Assessment limits
The division of responsibilities varies across services and agreements. Provider documentation does not by itself prove that a customer's configuration or operational processes are correct.
Frequently asked questions
Does a managed service remove customer security responsibilities?
No. The customer generally retains responsibilities for decisions such as identities, data and service configuration, depending on the service.
Can a cloud pentest verify the provider's entire platform?
No. The engagement must respect the authorized scope and provider rules; obtain provider evidence through its documented channels.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.