Data governance and lifecycle management is the responsibility the cloud customer always retains.

Data governance and lifecycle management includes decisions about data classification access control retention policies encryption keys and deletion. Cloud providers can offer tools for storage backup encryption and key management but they do not determine your business rules compliance obligations or the retention and disposal of your data so the customer remains accountable across IaaS PaaS and SaaS.

Operating system and server patching is not always the customer responsibility because in PaaS and SaaS the provider manages the operating system and server maintenance. It is a customer task in IaaS but that variability means it is not a duty the customer always retains.

Network configuration and routing can be the customer responsibility in IaaS and in some PaaS offerings where virtual networks are under customer control. Managed SaaS offerings shift network management to the provider so this is not universally the customer responsibility.

Data center physical security is managed by the cloud provider and their hosting partners. Customers rely on provider controls for facility access environmental protections and hardware security so physical security of the data center is not a customer retained duty.

Full AWS Practitioner Certification Question