Shared responsibility and cost

Why it matters

Two of the most common cloud disasters have nothing to do with clever attacks. The first is a storage bucket left open to the public because someone assumed "the cloud provider handles security". The second is a surprise bill because a large instance ran for a month after a tutorial ended. This lesson covers both: who is responsible for security, and how cloud pricing works so that you can control it.

The shared responsibility model

Every major provider publishes a shared responsibility modelThe split in which the provider secures the cloud itself and the customer secures what they put in it, especially identities and data.. The short version: the provider is responsible for security of the cloud, and you are responsible for security in the cloud.

The line moves with the service model. On a VM you patch the operating system; on a managed database the provider patches the engine; on SaaS the provider runs almost everything. But your data and your identities are always yours. No provider will stop you from making your own bucket public if your account allows it.

How cloud pricing works

Most bills come from a few meters:

• Compute time: per second or hour that a VM or container runs, by size. A stopped VM usually stops compute charges, but its disk still costs money.
• Storage: per GB per month, plus per request for object storage.
• Data transferMoving data in or out of the cloud; inbound is usually free, while outbound to the internet or between regions is charged per GB.: data coming in is usually free; data going out to the internet, or between regions, is charged per GB.
• Managed services: per hour, per request or per unit of capacity.
• Things people forget: public IPv4 addresses, NAT gateways, load balancers, snapshots and log storage all charge while they exist, even if nothing uses them.

Ways to pay less: turn off what is not in use, right-sizeTo choose the smallest resource size that still does the job, so you do not pay for unused capacity. (pick the smallest size that works), use commitments (reserved instances or savings plans) for steady workloads, and use spot or preemptible capacity for interruptible jobs.

Worked example: estimating a small app

Suppose a tutorial asks you to run one small Linux VM 24 hours a day, with a 20 GB disk and about 10 GB of downloads a month. Using the provider's pricing calculator (for AWS, the AWS Pricing Calculator at calculator.aws) you would add:

VM:         hours per month (about 730) x hourly price for the size
Disk:       20 GB x price per GB-month
Public IP:  about 730 hours x price per IP-hour
Transfer:   10 GB out x price per GB (after any free allowance)
Total:      sum of the above, per month

Prices change and differ by region, so always use the calculator rather than numbers from a blog post. Notice how a VM that is "only a few cents an hour" still adds up over 730 hours.

Free tiers, and why a budget alert comes first

All three big providers offer a way to learn for free, but the rules differ and they change. At the time of writing, AWS offers new accounts a Free plan with credits for a limited period, where you are not charged unless you upgrade to a paid plan; Azure and Google Cloud offer trial credits plus some always-free services. Read the current terms on the official pages: AWS Free Tier, Azure free services and Google Cloud free program. Checked on 2026-10-23.

Whatever plan you are on, set a budget alertA notification sent when actual or forecast spend crosses a threshold; it warns but does not stop spending. before you create any resource. A budget alert emails you when actual or forecast spend crosses a threshold. On AWS, Billing and Cost Management offers a "zero spend" budget template that alerts you as soon as you spend anything at all. Alerts do not stop spending by themselves, but they turn a month-long surprise into a same-day email.

Common mistakes

• Assuming the provider will stop you from exposing your own data.
• Using the root (account owner) login for daily work instead of a separate user with MFA.
• Stopping a VM and forgetting its disk, snapshot or public IP, which keep billing.
• Following a tutorial in an expensive region or with a large default size.
• Creating resources before setting a budget alert.

Quick recap

• Provider: security of the cloud. You: security in the cloud, especially identities and data.
• Bills come from compute time, storage, data out, managed services and forgotten extras.
• Estimate with the official calculator, learn on a free tierA provider's limited free usage or credits for learning; the rules differ by provider and change over time., and set a budget alert first.

Try it

Open the Do tab: you will estimate a small workload with a pricing calculator and set up your budget alert, which the rest of this course depends on.