NIST SP 800-210 General Access Control Guidance for Cloud Systems 2a: Settle the shared access control responsibilities between consumer, provider and any underlying IaaS provider

What does 2a require?

The split of access control duties is worked out for each service model: in IaaS the consumer controls the middleware, data, application and operating system layers; in PaaS consumer developers share duties with the provider; in SaaS internal application users share them. Where a PaaS or SaaS provider runs on another party's IaaS, it manages access control jointly with that IaaS provider and the consumer unless the consumer has expressly approved otherwise, and it tells the consumer where the data will be stored and how far that provider, outside parties or public authorities could reach it.