Security and Compliance is a shared responsibility between AWS and the customer. This shared model can help relieve the customers operational burden as AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates. Customers should carefully consider the services they choose as their responsibilities vary depending on the services used, the integration of those services into their IT environment, and applicable laws and regulations. The nature of this shared responsibility also provides the flexibility and customer control that permits the deployment.”]
Source: https://aws.amazon.com/compliance/shared-responsibility-model/