// Module included in the following assemblies:
//
// * rosa_architecture/rosa_policy_service_definition/rosa-policy-responsibility-matrix.adoc

:_mod-docs-content-type: CONCEPT
[id="rosa-policy-responsibilities_{context}"]
= Shared responsibilities for {product-title}

While Red{nbsp}Hat and Amazon Web Services (AWS) manage the {product-title} services, the customer shares certain responsibilities. The {product-title} services are accessed remotely, hosted on public cloud resources, created in customer-owned AWS accounts, and have underlying platform and data security that is owned by Red{nbsp}Hat.

[IMPORTANT]
====
If the `cluster-admin` role is added to a user, see the responsibilities and exclusion notes in the link:https://www.redhat.com/en/about/agreements[Red{nbsp}Hat Enterprise Agreement Appendix 4 (Online Subscription Services)].
====

[cols="2a,3a,3a,3a,3a,3a",options="header"]
|===

|Resource
|Incident and operations management
|Change management
|Access and identity authorization
|Security and regulation compliance
|Disaster recovery

|Customer data |Customer |Customer |Customer |Customer |Customer

|Customer applications |Customer |Customer |Customer |Customer |Customer

|Developer services |Customer |Customer |Customer |Customer |Customer

|Platform monitoring |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat

|Logging |Red{nbsp}Hat |Red{nbsp}Hat and Customer |Red{nbsp}Hat and Customer |Red{nbsp}Hat and Customer |Red{nbsp}Hat

|Application networking |Red{nbsp}Hat and Customer |Red{nbsp}Hat and Customer |Red{nbsp}Hat and Customer |Red{nbsp}Hat |Red{nbsp}Hat

|Cluster networking 
|Red Hat ^[1]^ 
|Red Hat and Customer ^[2]^ 
|Red Hat and Customer 
|Red Hat ^[1]^ 
|Red Hat ^[1]^

|Virtual networking management |Red{nbsp}Hat and Customer |Red{nbsp}Hat and Customer |Red{nbsp}Hat and Customer |Red{nbsp}Hat and Customer |Red{nbsp}Hat and Customer

|Virtual compute management (control plane, infrastructure and worker nodes) |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat

|Cluster version |Red{nbsp}Hat |Red{nbsp}Hat and Customer |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat

|Capacity management |Red{nbsp}Hat |Red{nbsp}Hat and Customer |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat

|Virtual storage management |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat |Red{nbsp}Hat

|AWS software (public AWS services) |AWS |AWS
|AWS |AWS |AWS

|Hardware/AWS global infrastructure |AWS |AWS |AWS |AWS |AWS

|===
1. If the customer chooses to use their own CNI plugin, the responsibility shifts to the customer.
2. The customer must configure their firewall to grant access to the required OpenShift and AWS domains and ports before the cluster is provisioned. For more information, see "AWS firewall prerequisites".