Learn Cloud Foundations by Mapping Who Does What

A team moves an application into the cloud. Someone says, “The provider handles security now.” Before accepting that statement, ask which responsibilities they mean and which service the team selected.

AWS describes security as shared between the provider and the customer. AWS protects the infrastructure running its services, while customer responsibilities depend on the services and their use. The official AWS shared responsibility model is the starting reference for those boundaries.

You can practise applying this idea without creating a cloud account.

Describe a fictional workload

Imagine a small organization storing internal training documents in a cloud service. You have not been told the exact service, the intended users, the data classification or the operating arrangements.

Do not fill those gaps with convenient assumptions. Write them as questions. A responsibility map becomes useful when it shows what must be established, as well as what is already known.

Separate the kinds of work

Create rows for infrastructure, account access, data handling, monitoring and incident response. For each, describe the actual activity rather than writing only “security.”

“Who can approve a new reader?” is more useful than “Who owns access?” “Who reviews an alert and decides what to do next?” is more useful than “Who owns monitoring?” Specific activities make unclear handoffs easier to identify.

Use a blank or an explicit question where you cannot assign responsibility. Do not assign everything to the provider or to a generic IT team just to complete the table.

Add an internal owner

A provider/customer boundary is only the first layer. The organization still needs to know which internal role makes a decision, performs an authorized action and checks the result.

For each row, record the service documentation you would consult, the internal owner you would ask and the evidence needed to confirm the arrangement. Keep a proposed responsibility visibly separate from one the relevant people have accepted.

Test one change

Now change the fictional scenario: a contractor finishes their work. What questions does that create about access, document ownership and any continuing responsibilities?

You are not configuring a real system. You are testing whether your map helps the organization identify an appropriate owner and next step when circumstances change.

Your completed exercise should include a workload description, an activity-level map, unresolved questions and one change scenario. A reviewer should see which conclusions follow from documentation and which still need confirmation.

Explore READY's AWS Cloud Practitioner-themed training for more cloud-foundations learning. Lessons require a free READY account. The written responsibility-map exercise above needs no paid cloud deployment. READY is independent of AWS and does not award AWS certification or provide an exam voucher.