Explain who secures what in the cloud, estimate a monthly bill and set a budget alert before building anything.
Why it matters
Two of the most common cloud disasters have nothing to do with clever attacks. The first is a storage bucket left open to the public because someone assumed "the cloud provider handles security". The second is a surprise bill because a large instance ran for a month after a tutorial ended. This lesson covers both: who is responsible for security, and how cloud pricing works so that you can control it.
The shared responsibility model
Every major provider publishes a shared responsibility model. The short version: the provider is responsible for security of the cloud, and you are responsible for security in the cloud.
| Provider (security of the cloud) | You (security in the cloud) |
|---|---|
| Physical data centres, guards, hardware | Who can log in (IAM users, roles, MFA) |
| The network between data centres | Firewall rules and security groups you create |
| The virtualisation layer | Patching the OS on your VMs (IaaS) |
| Managed service infrastructure | Your application code and its dependencies |
| Your data: classification, encryption settings, backups, public or private access |
The line moves with the service model. On a VM you patch the operating system; on a managed database the provider patches the engine; on SaaS the provider runs almost everything. But your data and your identities are always yours. No provider will stop you from making your own bucket public if your account allows it.
How cloud pricing works
Most bills come from a few meters:
- Compute time: per second or hour that a VM or container runs, by size. A stopped VM usually stops compute charges, but its disk still costs money.
- Storage: per GB per month, plus per request for object storage.
- Data transfer: data coming in is usually free; data going out to the internet, or between regions, is charged per GB.
- Managed services: per hour, per request or per unit of capacity.
- Things people forget: public IPv4 addresses, NAT gateways, load balancers, snapshots and log storage all charge while they exist, even if nothing uses them.
Ways to pay less: turn off what is not in use, right-size (pick the smallest size that works), use commitments (reserved instances or savings plans) for steady workloads, and use spot or preemptible capacity for interruptible jobs.
Worked example: estimating a small app
Suppose a tutorial asks you to run one small Linux VM 24 hours a day, with a 20 GB disk and about 10 GB of downloads a month. Using the provider's pricing calculator (for AWS, the AWS Pricing Calculator at calculator.aws) you would add:
VM: hours per month (about 730) x hourly price for the size
Disk: 20 GB x price per GB-month
Public IP: about 730 hours x price per IP-hour
Transfer: 10 GB out x price per GB (after any free allowance)
Total: sum of the above, per month
Prices change and differ by region, so always use the calculator rather than numbers from a blog post. Notice how a VM that is "only a few cents an hour" still adds up over 730 hours.
Free tiers, and why a budget alert comes first
All three big providers offer a way to learn for free, but the rules differ and they change. At the time of writing, AWS offers new accounts a Free plan with credits for a limited period, where you are not charged unless you upgrade to a paid plan; Azure and Google Cloud offer trial credits plus some always-free services. Read the current terms on the official pages: AWS Free Tier, Azure free services and Google Cloud free program. Checked on 2026-10-23.
Whatever plan you are on, set a budget alert before you create any resource. A budget alert emails you when actual or forecast spend crosses a threshold. On AWS, Billing and Cost Management offers a "zero spend" budget template that alerts you as soon as you spend anything at all. Alerts do not stop spending by themselves, but they turn a month-long surprise into a same-day email.
Common mistakes
- Assuming the provider will stop you from exposing your own data.
- Using the root (account owner) login for daily work instead of a separate user with MFA.
- Stopping a VM and forgetting its disk, snapshot or public IP, which keep billing.
- Following a tutorial in an expensive region or with a large default size.
- Creating resources before setting a budget alert.
Quick recap
- Provider: security of the cloud. You: security in the cloud, especially identities and data.
- Bills come from compute time, storage, data out, managed services and forgotten extras.
- Estimate with the official calculator, learn on a free tier, and set a budget alert first.
Try it
Open the Do tab: you will estimate a small workload with a pricing calculator and set up your budget alert, which the rest of this course depends on.