Shared Security Responsibility Model
On Alibaba Cloud, security and compliance is a shared responsibility: Alibaba Cloud secures the cloud platform itself, and you secure what you build and run on it.
This boundary determines which controls you must implement yourself and which you inherit automatically.
How responsibility is divided
The model splits into two domains:
Alibaba Cloud is responsible for security of the cloud — the underlying infrastructure that all services run on:
Physical and hardware security of data centers across regions and availability zones
Security of computing, storage, and network devices
The virtualization layer and cloud services layer running on the Feitian distributed cloud operating system
Platform-side identity management, access control, monitoring, and operations to keep cloud services available and secure
You are responsible for security in the cloud — everything you configure, deploy, and operate on top of Alibaba Cloud:
Securely configuring the cloud services you use
Building and operating workloads that meet your security and compliance requirements
Applying the security capabilities that Alibaba Cloud provides to protect your data and applications
The following figure illustrates this division:
Cloud-native security services
Alibaba Cloud leverages years of attack and defense technology accumulation from Alibaba Group to provide customers with cloud-native security services to protect their workloads and businesses.