Shared responsibility and security reviews: the Well-Architected security pillar, Trusted Advisor and threat modeling

Security on AWS is shared. AWS is responsible for security of the cloud: the facilities, hardware, network, and the virtualization layer, and for managed services also the operating systems and platform software it runs. You are responsible for security in the cloud: your data, identities and access, network configuration, encryption choices, and anything you install. The split moves with the service. On EC2 you patch the guest operating system; on RDS AWS patches the host and the database software, you choose when engine upgrades are applied, and you still control network access, users and encryption; on Lambda or S3 you mostly configure access and data protection.