Cloud shared responsibility: IaaS vs PaaS vs SaaS explained
In every cloud model the provider runs the underlying infrastructure, and the customer secures what it controls. In IaaS that includes the operating systems, storage and applications; in PaaS the deployed applications; in SaaS little more than user-specific settings. Code the customer writes, including serverless functions, stays the customer's to secure.
What each model leaves to the customer
NIST SP 800-145 defines the three service models by what the consumer controls. In IaaS the consumer does not manage the underlying infrastructure but controls operating systems, storage and deployed applications, and possibly some networking such as host firewalls. Patching the guest operating system on a rented virtual machine is the customer's job; the hypervisor and physical hardware are not.
In PaaS the consumer controls its deployed applications and possibly the hosting environment's settings, but not the network, servers, operating systems or storage. In SaaS, such as web-based email, the consumer controls almost nothing beyond limited user-specific application settings.
The shared model
CISA's Cloud Security Technical Reference Architecture describes a shared security model. In SaaS most responsibility sits with the provider, which also means the customer places more trust in it. In IaaS much of the responsibility falls on the customer. CISA notes that providers define the split differently, so customers must identify the split with each provider and set it out in service level agreements.
Serverless
With serverless functions the provider runs the code only when it is triggered, and the customer manages no servers. The OWASP Serverless Top 10 project says some security moves to the provider, but the functions still execute the customer's code. If that code is insecure, it is still open to application-level attacks such as injection, and fixing it is the customer's job.
Where the exam catches people
Believing the provider patches everything in IaaS: the customer patches the guest operating systems and applications it runs.
Believing serverless moves code flaws to the provider: an injection flaw in your function is yours to fix.
Believing a SaaS customer can harden the mail servers: in SaaS the customer controls only limited user-specific settings.
Believing every provider draws the line in the same place: CISA notes the split differs between providers, so it must be agreed with each one.