In the AWS shared responsibility model, AWS is responsible for protecting the infrastructure that runs AWS services. This infrastructure is composed of the hardware, software, networking, and facilities that run AWS Cloud services. Your role as a customer includes managing the guest operating system (including updates and security patches), other associated application software, and the configuration of the AWS provided security group firewall. Thus, keeping the underlying hypervisor secure falls under AWS's responsibility, while applying security groups to your EC2 instances must be managed by the customer.