AWS states in their official literature that "Security is a shared responsibility of AWS and the Customer."
AWS is responsible for maintaining the security of the cloud, which includes datacentres, hardware, facilities, and enabling services. It also provides added Data Encryption at rest, Distributed Denial of Services (DDOS) mitigation, an Automated Security recommendation engine, and a robust Identity and Access-Management solution for helping the customer to harden their environments further.
The customer is responsible for maintaining security in the cloud. It basically depends on the service of AWS that is being used. The customer is typically responsible for hardening the access controls to the resources, encryption, and managing firewall settings to control the traffic to the cloud.
Some of the shared responsibilities include patch management...