Modeli i Përgjegjësisë së Ndarë

The shared responsibility model is the cornerstone of cloud security: the cloud provider secures the cloud, and the customer secures what they put in the cloud.

For infrastructure-as-a-service, the provider is responsible for the physical data center, the hypervisor, the host operating system and the network fabric. The customer is responsible for everything above: the guest OS, patches, applications, data, IAM configuration, encryption keys and network rules. For platform-as-a-service the line moves up — the provider now manages the OS and runtime — and for software-as-a-service it moves further, leaving the customer mostly responsible for data and access management. Misunderstanding this line is a leading cause of cloud breaches. An S3 bucket left public is the customer's responsibility, not AWS's. An IAM role with AdministratorAccess attached to an EC2 instance is the customer's responsibility. A container image with a known CVE is the customer's responsibility. AWS, Azure and GCP provide tools to configure these things safely, but the decisions and the default behaviors are the customer's. Each major provider publishes its own shared responsibility matrix and mapping to frameworks like CIS benchmarks and NIST 800-53. Every cloud security program should start with ingesting those benchmarks and running automated scans (Prowler, ScoutSuite, Steampipe, CloudSploit) to see where the customer side stands.

Referenca:

• AWS Shared Responsibility Model.
• Azure responsibility matrix.
• GCP shared fate.

Shembull: kush çfarë bën në AWS IaaS (EC2):

Shtresa	AWS	Klient
Data center fizik	✓
Hypervisor	✓
Guest OS, patches		✓
IAM policies		✓
Data encryption	(KMS tool)	✓ konfigurimi
App code + deps		✓

1. Bëj mapping të një arkitekture (EC2 + RDS + S3) kundrejt shared responsibility.
2. Identifiko ku gabime të klientit shkaktojnë breach.

• AWS Well-Architected — Security Pillar.
• Cloud Security Alliance — CCM.