Which task is the customer's responsibility, according to the AWS shared responsibility model?

For services like Amazon EC2, customers are responsible for the security *in* the cloud, which includes tasks such as managing and patching the guest operating system, applications, and network configuration on their EC2 instances. AWS handles the underlying infrastructure, but the OS and application within the instance are the customer's purview.

Controlling physical access to AWS data centers is an AWS responsibility, as it relates to the physical security of the underlying infrastructure.

Controlling access to AWS underlying hardware is an AWS responsibility, falling under the "security *of* the cloud."

Amazon S3 is a fully managed service where AWS is responsible for patching the underlying host operating system; customers do not deploy host operating systems on S3.