AWS is responsible for the infrastructure that runs all of the services offered in the AWS Cloud. For EC2, this includes the physical security of the hardware as well as installing security patches for the hypervisor. The customer is responsible for managing the guest OS, including any additional security patches.