A team uses a managed PaaS database service. The provider runs the database engine and its hosts, but a developer added a network rule allowing access from any internet address, and the data was scraped. Who is responsible for the exposure?

In PaaS, the provider manages the underlying infrastructure, operating systems and the platform software, such as the database engine, including its patching and availability. The customer controls its deployed applications and the configuration settings exposed by the service, which include network access rules, authentication options, encryption choices and who holds credentials. A rule permitting access from any address is a customer configuration decision, so the resulting exposure is a customer responsibility. Running the engine does not make the provider the owner of every setting; the service deliberately exposes access controls so customers can choose who reaches their data. Providers generally do not forbid public access, because some workloads legitimately need it; they may warn or offer secure defaults, but the decision remains with the customer. Saying no one is responsible ignores the explicit division that every shared responsibility model documents, and responsibility for data and access is consistently assigned to the customer. Exam caveat: misconfiguration of customer-controlled settings, rather than provider failures, is one of the most common causes of cloud data exposure. Operational check: review the service's network access settings for broad address ranges, restrict access to private connectivity or known sources, enable authentication and auditing, and use posture management to alert when public access rules reappear.