According to the AWS Shared Responsibility Model:

• Physical security (C): AWS is responsible for the physical security of their data centers, including access control, surveillance, and environmental controls.

• Disk disposal (D): AWS manages the secure disposal of storage devices and hardware when they reach end-of-life.

• Hardware patching (E): AWS is responsible for patching and maintaining the underlying hardware infrastructure.

Customer Responsibility:

• Password policies (A): Customers manage their own IAM user password policies
• User permissions (B): Customers control user access and permissions through IAM policies

The Shared Responsibility Model clearly defines that AWS manages security OF the cloud (infrastructure), while customers manage security IN the cloud (their data, applications, and configurations).