In the AWS shared responsibility model, AWS is responsible for the security 'of' the cloud, meaning they maintain the infrastructure that runs all of the services offered in the AWS Cloud. The customer, on the other hand, is responsible for the security 'in' the cloud; this includes things like managing the security groups (which act as virtual firewalls), patching the EC2 instance operating systems, and ensuring that data is encrypted as necessary. While AWS provides the tools, such as VPC and security group configurations, the customer must implement those tools correctly.