The cloud secures the cloud. You secure what's inside it.
The line between provider and customer responsibility moves depending on the service model — and most real cloud breaches happen because a customer misconfigured their own side of it.
Service modelProvider handlesYou handle
IaaS — EC2 VMs Physical hardware, hypervisorOS patching, network config, app code, data
PaaS — RDS, Beanstalk Above + OS & runtime patchingApp code, data, access configuration
SaaS — Workspace Above + the application itselfYour data, user access management
"The cloud provider secures the cloud; you secure what you put in it and how you configure it." Most real breaches are a public S3 bucket or an over-permissive IAM role — the customer's side, not the provider's.