Introduction
Understanding organizationsUnderstanding componentsManage organizationsManage componentsManage component Jira integrations
Set up your first organizationUnderstanding users and teamsUnderstanding role-based access controlManage usersManage teamsConfigure role-based access controlRBAC permissions reference
Understanding authentication in CloudBees UnifySet up multifactor authenticationConfigure SAML single sign-onConfigure OIDC authenticationConfigure network security policiesNetwork security reference
Understanding platform configurationUnderstanding environmentsManage properties and secretsManage environmentsTrack environment inventoryConfigure containersSet up preconfigured actionsConfigure notifications
Accessibility policy referenceShared responsibility model referenceSubscription and services agreementSupport policiesSupported browsers and external tools
Introduction
Understanding feature managementUnderstanding Configuration as CodeGet started with feature managementCreate and manage feature flagsConfigure feature flag targetingOrganize feature flagsImplement feature flag governanceConfiguration as Code reference
Understanding flag impressions and activity statusUnderstanding flag healthUnderstanding code referencesReview and clean up feature flagsSet up code references
Understanding Jira integration for feature flagsSet up the Jira integrationLink Jira tickets to feature flags
Understanding multiple SDK keysBuild your first mobile app with feature flagsBuild your first feature-flagged web applicationBuild your first feature-flagged backend serviceInstall client-side SDKsInstall server-side SDKsConfigure multiple SDK keysMobile SDK referenceWeb SDK referenceBackend SDK referenceClient SDK referenceFlag implementation reference
Introduction
Understanding CI workflowsCreate a build workflowCreate and manage workflowsCreate reusable workflowsTest and validate containers in workflowsCheck out source codeTrigger workflows remotelyWorkflow syntax referenceJobs syntax referenceSteps syntax referenceServices syntax reference
Monitor workflow runsView test results in runsView evidence in runsView deployments in runsManage workflow artifactsPublish test resultsPublish evidence itemsGenerate a software bill of materialsManage ServiceNow change requests
Configure workflow credentialsConfigure AWS credentialsConfigure container registry credentialsConfigure Git credentialsIntegrate external secret providers
Understanding GitHub Actions integrationSet up GitHub Actions integrationDisplay GitHub Actions workflows and runsRegister GHA build artifactsPublish GHA deployed artifactsPublish GHA test resultsPublish GHA evidence itemsTrigger CloudBees workflows from GitHub ActionsScan with GitHub Actions
Understanding CloudBees CI and Jenkins® integrationConnect CI and Jenkins controllersMonitor CI and Jenkins buildsRegister CI build artifactsRegister CI deployed artifactsPublish CI test resultsConfigure CI security scanningCI and Jenkins integration reference
Build and publish container imagesUnderstanding external CI/CD integrationsRun external CI/CD jobsExternal CI/CD action reference
Introduction
Understanding release orchestrationManage applicationsCreate deployer workflowsCreate staged workflowsCreate and manage releasesOrchestrate multi-workflow releasesRelease management reference
Understanding artifact managementRegister and track artifactsStore and retrieve artifactsPromote artifactsGenerate a software bill of materialsArtifact management reference
Deploy with HelmDeploy to KubernetesContainer deployment reference
Deploy to AWSAWS deployment reference
Deploy with enterprise platformsExecute remote deployment commandsEnterprise deployment reference
Verify deployments with New RelicDeployment verification reference

Shared responsibility model reference

3 minute read

Security and operational responsibilities for CloudBees Unify are divided between CloudBees and customers according to a shared responsibility model. Use this reference when evaluating security compliance requirements, incident response procedures, or operational responsibilities.

Shared responsibility model definition

A shared responsibility model in a cloud environment is a formal framework that clearly defines and divides security and compliance duties among the different parties involved in a cloud service relationship. When a Software as a Service (SaaS) provider builds its application on a public cloud (such as AWS), the model becomes a three-party agreement that allocates responsibility based on who has operational control over each component of the service stack:

  • AWS (cloud infrastructure provider): Responsible for security of the cloud, including:

    • Physical hardware.

    • Host operating systems and virtualization layers.

    • Global network resilience including disaster recovery for core infrastructure.

  • CloudBees (SaaS provider): Responsible for security in the cloud, including:

    • CloudBees Unify and CloudBees Smart Tests product code.

    • Security, updates, support, and patch management for CloudBees Unify and CloudBees Smart Tests.

    • Cloud environment provisioning and configuration, including VPCs, firewalls, and network controls.

    • Service continuity planning, including maintenance of status pages.

    • Data recovery at the CloudBees Unify and CloudBees Smart Tests level.

    • Incident response for software vulnerabilities.

    • Documentation and knowledge bases for CloudBees Unify and CloudBees Smart Tests, including security best practices.

  • Customer (you): Responsible for security of your usage, including:

    • Data ownership.

    • User access management including enforcing MFA and role-based access controls.

    • Configuring application security settings.

    • Implementing additional backup strategies if required for specific data retention or recovery needs.

Responsibility matrix

Table 1. Detailed responsibilities
Responsibility area Cloud service provider (AWS) SaaS provider (CloudBees Unify) Customer (you)

Physical security

Global infrastructure, data centers, hardware, networking, and physical facilities.

Not applicable. Inherited from AWS.

Not applicable.

Core infrastructure

Security of the cloud, including the virtualization layer, host operating system, and base network security.

Configuration of the AWS-provided infrastructure (for example, VPCs, security groups, IAM for the AWS account).

Not applicable.

Application & code

Not applicable.

The core SaaS application, its code, deployment, maintenance, updates, and web application firewalls (WAF). Guidance on secure usage of the product.

Configuration of the application.

Patch management

Patching the underlying hardware and host operating system.

Patching the guest operating systems (if using IaaS), middleware, runtime environments, and the SaaS application itself.

Not applicable.

Identity & access management (IAM)

Availability of AWS IAM and core service endpoints.

Application’s user access service, including user roles and permissions, and access to infrastructure by CloudBees employees.

Managing user accounts, secrets, passwords, enabling/enforcing MFA, single sign-on (SSO), integrations, and user behavior.

Data & encryption

Providing encryption tools (for example, KMS, EBS/S3 encryption features).

Implementing data classification policies, configuring encryption settings (at rest/in transit).

Data ownership, data quality, legal/regulatory compliance (for example, GDPR, HIPAA), and controlling data-sharing permissions within the application.

Monitoring & logging

Provides the raw infrastructure logging capabilities/tooling (for example, CloudTrail and CloudWatch logs).

Collecting, analyzing, and acting on logs, tool configuration, establishing threat detection, and providing security incident response for the SaaS application.

Monitoring your own user activity, usage, and reporting suspicious behavior to CloudBees Unify.

Incident management

Detecting and resolving incidents affecting the underlying AWS infrastructure.

Detecting, containing, and remediating incidents within the application or its managed cloud environment. CloudBees must notify customers of security incidents impacting their data.

Incident response actions related to your employees, endpoints, or credentials (for example, disabling compromised user accounts and initiating local device forensic analysis).

Disaster recovery

Resilience and recoverability of the AWS Region/service itself (for example, availability zones and region failover for core services).

Maintaining business continuity through application-level disaster recovery (DR) planning, multi-region failover, and ensuring RTO/RPO for the application’s overall function.

Responsible for your own data backup and recovery plan for individual data loss events (for example, accidental or malicious deletion). You may need a third-party backup solution for granular recovery.

Legal and compliance note

This shared responsibility model is provided for informational purposes only and is not intended to be exhaustive. This document provides an overview of general principles and does not supersede the specific terms, conditions, and security obligations outlined in the CloudBees Subscription and Services Agreement and CloudBees Terms of Service (TOS).

Related pages

Accessibility policy reference
Subscription and services agreement