Under the AWS shared responsibility model, which of these is the customer's responsibility?

Under the AWS shared responsibility model, security in the cloud is the customer's responsibility, while security of the cloud is AWS's responsibility. Managing the guest operating systems, including patching and security configurations, falls under the customer's domain. AWS is responsible for the underlying infrastructure, such as maintaining the physical infrastructure devices, managing the host operating systems and virtualization, and maintaining the software that runs Availability Zones. These are all aspects of "security of the cloud" that AWS manages.