Summary
- The provider secures parts of the platform; the customer still owns identities, data choices, configuration and access.
- A credible control set includes least privilege, change logs, independent backups and a timed restore.
Cloud security is a shared operating model, not a feature purchased once. The boundary changes with infrastructure, platform and software services, so teams must name who patches each layer, who can grant access and where sensitive data resides. Automated policy checks help only when exceptions are reviewed and risky changes can be reversed. The next useful evidence is a recovery exercise using credentials and backups that do not depend on the failed account. A secure design is demonstrated when identity compromise or provider disruption can be contained and restored.
