[Securing the Cloud] In a PaaS model, which layer is the tenant responsible for maintaining and patching?

In the Platform as a Service (PaaS) shared responsibility model, the cloud provider is responsible for the underlying infrastructure, including the physical hardware, network, hypervisor, and the operating system. The tenant (customer) is responsible for what they build on the platform. This explicitly includes the applications they deploy and the data those applications process and store. Therefore, the tenant is solely responsible for maintaining, patching, and securing their own application code and its dependencies.

A. hypervisor: The hypervisor is part of the virtualization infrastructure managed and patched by the cloud service provider in IaaS, PaaS, and SaaS models.
B. virtual machine: The underlying operating system and runtime environment, which reside on a virtual machine or container, are managed by the provider in a PaaS model.
C. network: The physical network and core networking infrastructure are the responsibility of the cloud provider. The tenant manages network configurations for their application, not the underlying hardware.

1. National Institute of Standards and Technology (NIST) Special Publication 800-145

"The NIST Definition of Cloud Computing":

Section 2

Service Models

Platform as a Service (PaaS): "The consumer does not manage or control the underlying cloud infrastructure including network

servers

operating systems

or storage

but has control over the deployed applications and possibly configuration settings for the application-hosting environment."

2. Microsoft Azure Documentation

"Shared responsibility in the cloud":

"Responsibility zones" diagram: The chart clearly designates "Application" and "Data" as customer responsibilities in the PaaS column

while "Operating system

" "Network controls

" and "Physical host" are provider responsibilities.

3. Amazon Web Services (AWS) Documentation

"AWS Shared Responsibility Model":

"Shared Controls" section: This section explains that for abstracted services like PaaS

"AWS operates the infrastructure layer

the operating system

and platforms

and customers access the endpoints to store and retrieve data. Customers are responsible for managing their data... and the application itself."

4. Cisco

"Cisco Secure Cloud Architecture" Design Guide:

Chapter 1

"Cloud Computing Models"

Section "Platform as a Service (PaaS)": This section describes PaaS as a model where the provider supplies the platform (OS

middleware

runtime)

and the customer is responsible for "developing

running

and managing their own applications" on that platform.