Hello, I'm Ganesh. I'm building git-lrc, an AI code reviewer that runs on every commit. It is free, unlimited, and source-available on Github. Star git-lrc on GitHub to help more developers discover the project. Do give it a try and share your feedback for improving the product.
One of the biggest misconceptions about cloud computing is that once you move to the cloud, the cloud provider takes care of everything.
While cloud providers manage a significant portion of the infrastructure, customers still have important security and operational responsibilities.
This concept is known as the Shared Responsibility Model.
The division of responsibilities changes depending on whether you're running workloads On-Premises, using Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS).
Let's break it down.
On-Premises: You Manage Everything
When your applications run in your own data center, every component is your responsibility.
Customer Responsibilities
- Data
- Devices
- Accounts
- Identity and Access Management (IAM)
- Applications
- Network controls
- Operating systems
- Infrastructure
- Physical servers
- Physical networking
- Datacenter facilities
What the Provider Manages
Nothing.
Since everything is hosted on your own infrastructure, there is no cloud provider to share operational responsibilities.
Infrastructure as a Service (IaaS)
Examples include virtual machines such as Amazon EC2, Azure Virtual Machines, and Google Compute Engine.
With IaaS, the provider supplies the infrastructure while you manage everything running on top of it.
Customer Responsibilities
- Data
- Devices
- Accounts
- Identity and Access Management
- Applications
- Network controls (firewalls, security groups, etc.)
- Operating systems
Cloud Provider Responsibilities
- Physical infrastructure
- Physical hosts
- Physical networking
- Datacenters
IaaS gives you the most flexibility among cloud service models, but it also requires the most operational management.
Platform as a Service (PaaS)
Examples include Azure App Service, AWS Elastic Beanstalk, Google App Engine, and Heroku.
PaaS removes the burden of managing operating systems and infrastructure, allowing developers to focus on building applications.
Customer Responsibilities
Shared Responsibilities
- Identity and Access Management
- Applications
- Network controls
Cloud Provider Responsibilities
- Operating systems
- Infrastructure
- Physical hosts
- Physical networking
- Datacenters
PaaS strikes a balance between flexibility and convenience, making it an excellent choice for many modern application deployments.
Software as a Service (SaaS)
Examples include Microsoft 365, Salesforce, Google Workspace, and Dropbox.
With SaaS, the provider delivers a complete application that users simply access through a web browser or client application.
Customer Responsibilities
Shared Responsibilities
- Identity and Access Management
Cloud Provider Responsibilities
- Applications
- Network controls
- Operating systems
- Infrastructure
- Physical hosts
- Physical networking
- Datacenters
SaaS offers the lowest operational overhead because the provider manages nearly the entire technology stack.
Shared Responsibility at a Glance
| Service Model |
Customer Manages |
Shared |
Provider Manages |
| On-Premises |
Everything |
None |
Nothing |
| IaaS |
OS, applications, IAM, network controls, data |
None |
Infrastructure & physical hardware |
| PaaS |
Data, devices, accounts |
IAM, applications, network controls |
OS, infrastructure & physical hardware |
| SaaS |
Data, devices, accounts |
IAM |
Applications, OS, infrastructure & physical hardware |
Conclusion
No matter which cloud service model you choose, your data, devices, and user accounts remain your responsibility.
As you move from On-Premises → IaaS → PaaS → SaaS, the cloud provider takes on progressively more responsibility, reducing your operational burden. However, protecting your users, managing access, and securing your data always remain critical tasks.
Understanding where your responsibilities begin—and where the provider's responsibilities end—is essential for building secure, reliable cloud solutions.
Any feedback or contributors are welcome! It's online, source-available, and ready for anyone to use.
⭐ Star git-lrc on GitHub