Explanation

Under the AWS Shared Responsibility Model:

AWS Responsibility (Security OF the Cloud):

• Physical security of data centers
• Hardware infrastructure
• Network infrastructure
• Host operating system
• Virtualization layer
• Patching underlying hardware

Customer Responsibility (Security IN the Cloud):

• Data encryption and protection
• Identity and access management (IAM)
• Application security
• Operating system configuration
• Network traffic protection
• Rotating passwords for database users

For Amazon RDS (Relational Database Service):

• AWS manages: Infrastructure, hardware, host OS, database engine installation, and basic maintenance
• Customer manages: Database configuration, user management, password rotation, data encryption settings, and application-level security

Why the other options are incorrect:

• Installing a host operating system: AWS manages the host OS for RDS instances
• Patching underlying hardware: AWS is responsible for hardware maintenance and patching
• Provisioning RDS infrastructure: AWS handles the infrastructure provisioning when you create an RDS instance

Password rotation is a security best practice that customers must implement for their database users to maintain security compliance and prevent unauthorized access.