🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Data Management / Database Administration › Cloud Storage for Database Administrators › Lesson 1
TEC-DATA86-08 · Lesson 1 · 10 clock hours · theory

Cloud Fundamentals and Shared-Responsibility Model for DBAs

Objective. Students will explain the shared-responsibility security model for IaaS, PaaS, and DBaaS tiers and identify which security controls the DBA must own on each major cloud platform.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What the Cloud Actually Is — A DBA's Working Definition

Cloud computing means accessing computing resources—servers, storage, databases, networking—over the internet from a provider who owns and operates the physical infrastructure. For a database administrator, the cloud is not a single thing; it is a spectrum of service models that each place different responsibilities on you and your employer. Understanding where your responsibility begins and ends is one of the most critical security skills you will develop in this program.

The Three Service Tiers That Matter to DBAs

Infrastructure as a Service (IaaS) gives you a virtual machine running on the provider's hardware. You install the operating system, install the database engine, patch both, configure the firewall, and manage backups. AWS EC2, Azure Virtual Machines, and Google Compute Engine are IaaS examples. The provider keeps the physical data center secure; you are responsible for almost everything above the hypervisor.

Platform as a Service (PaaS) removes the operating system layer from your plate. The provider manages the OS, the underlying hardware, and often the database engine patches. Azure App Service and Google App Engine are general PaaS examples. When a managed database engine runs under PaaS rules—such as Amazon RDS or Azure Database for PostgreSQL Flexible Server—you still own network access rules, user accounts, encryption key choices, and data classification.

Database as a Service (DBaaS) is a specialized PaaS offering focused entirely on a database engine. Examples include Amazon RDS, Amazon Aurora, Azure SQL Database, Azure Cosmos DB, Google Cloud SQL, and Google Cloud Spanner. The provider manages the engine software, high availability, automated backups, and hardware. You manage who can connect, what data goes in, how encryption is configured, and whether audit logging is turned on.

As you move from IaaS toward DBaaS, the provider takes on more operational burden—but you never hand over accountability for your data.

The Shared-Responsibility Model Explained

Every major cloud provider publishes a shared-responsibility model: a formal statement of which security controls the provider handles and which the customer must handle. AWS, Microsoft Azure, and Google Cloud each publish this as a publicly available whitepaper or documentation page. The model exists because a cloud customer who assumes the provider handles everything will leave serious security gaps.

The core principle is straightforward: the provider is responsible for security OF the cloud; the customer is responsible for security IN the cloud.

At the IaaS tier, your DBA responsibilities include:

At the PaaS/DBaaS tier, the provider absorbs:

But you retain responsibility for:

Why Misconfigurations Cause Breaches

The vast majority of cloud data breaches do not involve the provider's infrastructure being hacked. They involve customer-side misconfiguration: a database left publicly accessible without authentication, an overly permissive security group rule, encryption disabled, or audit logging never turned on. In each case, the provider did everything required under the model; the customer did not fulfill their side.

This is exactly why the shared-responsibility model is tested on credentials such as the Microsoft DP-300 and is a foundation topic in the DAMA DMBOK2. A DBA who cannot articulate which controls they own cannot protect their organization's data.

The Three Major Platforms — A Quick Orientation

Amazon Web Services (AWS): Managed database services live under the RDS family and include MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and the Aurora engine. Access control uses IAM policies combined with database-engine-level users. Security groups control network access.

Microsoft Azure: Managed databases include Azure SQL Database, Azure Database for PostgreSQL, Azure Database for MySQL, and others. Azure uses Role-Based Access Control (RBAC) at the platform level and native database logins at the engine level. Network access is controlled by firewall rules and virtual network service endpoints.

Google Cloud Platform (GCP): Cloud SQL supports PostgreSQL, MySQL, and SQL Server. Cloud Spanner and BigQuery serve specialized workloads. IAM controls platform-level access; database-engine users control data-level access. Authorized networks and Private Service Connect control connectivity.

Safety and Compliance Points

Cloud environments introduce unique operational risks:

Key terms8

Shared-Responsibility ModelA formal framework published by cloud providers that divides security duties between the provider (who secures the underlying infrastructure) and the customer (who secures their data, access controls, and configurations within that infrastructure).
IaaS (Infrastructure as a Service)A cloud service tier that provides virtualized compute, storage, and networking; the customer manages the operating system, middleware, and applications, including the database engine.
PaaS (Platform as a Service)A cloud service tier where the provider manages the operating system and runtime environment; the customer focuses on application deployment and data, not infrastructure maintenance.
DBaaS (Database as a Service)A specialized PaaS offering that delivers a fully managed database engine; the provider handles engine patching and hardware, while the customer manages access controls, encryption choices, and data.
Security Group / Firewall RuleA customer-configured network access control that specifies which IP addresses or network ranges are permitted to connect to a cloud resource such as a managed database instance.
Customer-Managed Key (CMK)An encryption key that the customer generates, stores, and controls (typically in a cloud key management service), giving the customer—rather than the provider—ultimate control over encrypted data.
Least PrivilegeThe security principle of granting users, roles, and applications only the minimum permissions required to perform their specific tasks, reducing the potential damage from mistakes or compromised accounts.
MisconfigurationAn incorrect or insecure setting applied to a cloud resource—such as leaving a database publicly accessible or disabling encryption—that creates a security vulnerability even when the provider's infrastructure is functioning correctly.
In class: Read and annotate the AWS, Azure, and Google Cloud shared-responsibility documentation; complete a side-by-side comparison table showing which controls belong to the provider versus the customer at each service tier. · Use the free tiers of AWS, Azure, and Google Cloud to navigate the consoles, create non-production accounts, and locate the managed database service menus—instructor demonstrates, students replicate step by step. · Case-study discussion: given a fictional data breach scenario involving a misconfigured cloud database, students identify which shared-responsibility boundary was violated and write a one-page root-cause summary.
Materials: AWS Free Tier account, Azure free account, Google Cloud free account; cloud provider shared-responsibility whitepapers (publicly available); Microsoft DP-300 study guide (Microsoft Press); DAMA DMBOK2 Chapter 6 (Data Storage and Operations)
Check: 10-question written quiz on shared-responsibility model, cloud service tiers, and DBA-owned controls; pass mark 70%.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Cloud security and database administration fundamentals (DP-300; CDMP Data Security)
1. Under the shared-responsibility model for DBaaS, which of the following controls is the customer responsible for configuring?
Shared-responsibility model and cloud security (DP-300; CDMP Data Security)
2. A DBA sets up Amazon RDS for PostgreSQL and leaves the database's security group open to all IP addresses (0.0.0.0/0) without requiring a password. A breach occurs. Which party failed under the shared-responsibility model?
Cloud service models (DP-300; CDMP Data Storage and Operations)
3. Which cloud service tier places the greatest number of security responsibilities on the DBA and their organization?
Encryption and key management (DP-300; CDMP Data Security)
4. A company needs to ensure their Azure SQL Database data remains encrypted and that only they—not Microsoft—can access the encryption keys. Which approach addresses this requirement?
Multi-cloud fundamentals (DP-300; CDMP Data Management Principles)
5. When comparing the shared-responsibility documentation of AWS, Azure, and Google Cloud, which statement is most accurate?
Compliance and data governance (CDMP Data Security; DP-300)
6. A DBA is provisioning Google Cloud SQL for a healthcare application. Before loading any patient data, what is the most important first step related to compliance?
Shared-responsibility model (DP-300; CDMP Data Security)
7. Which of the following best describes the 'security IN the cloud' concept from the shared-responsibility model?
Credential management and cloud security (DP-300; CDMP Data Security)
8. A DBA discovers that a colleague stored a production database password in a plain-text configuration file committed to a public version control repository. Which control would have prevented this risk according to cloud security best practices?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
Program planNext lesson →