Shared Responsibility, Control Planes, and Data Planes

What This Chapter Is About

Explain how responsibility shifts between provider and customer across infrastructure, managed services, and serverless models.

This chapter makes the provider/customer boundary precise: what a provider operates, what remains for the customer to design and verify, and why "managed" never means "nothing left to do."

The chapter develops one durable idea:

Managed services reduce operational burden, but they do not remove customer responsibility for identity, data, configuration, monitoring, cost, and risk.

Sections

1. Shared Responsibility as a Boundary Model

2. Control Planes and Data Planes

3. How Responsibility Shifts Across IaaS, PaaS, and Serverless

4. What the Customer Still Owns Even With Managed Services

How the Chapter Develops

The chapter develops in this order:

1. Define shared responsibility as a boundary model rather than a marketing slogan.

2. Separate control plane concerns from data plane concerns so readers can reason about access and operations clearly.

3. Compare IaaS, managed platforms, and serverless as shifts in who operates which layers.

4. Finish with the customer responsibilities that remain even when the platform is highly managed.

Together, these sections show that the real question is not whether a service is managed, but which responsibilities moved and which did not.

What You Will Be Able to Do

By the end of this chapter, the reader should be able to:

• Explain shared responsibility in practical architecture terms.

• Distinguish control plane activity from data plane activity.

• Describe how responsibility changes across infrastructure, platform, and serverless choices.

• Identify the responsibilities that stay with the customer even for managed services.

Key Ideas

• Shared responsibility is a shifting boundary, not a fixed list that applies equally to every service model.

• Control plane and data plane concerns often require different access, monitoring, and protection decisions.

• Greater abstraction reduces some operational tasks but leaves ownership for outcomes, risk, and governance with the customer.

• Backup, identity, network exposure, monitoring, and cost management still need deliberate design around managed services.

How to Use This Chapter

Apply the responsibility register and managed-service readiness questions to a service your team already uses. The exercise should reveal assumptions about configuration, verification, monitoring, or recovery that a generic shared-responsibility diagram does not show.