Cloud service providers like Amazon Web Services, Microsoft Azure and Google Cloud Platform have their own shared responsibility models which state, in the simplest terms, that while the cloud provider is responsible for the security of the cloud, customers are responsible for the security of the data and applications they upload to it.
This means that each cloud provider will manage security controls across its host operating system and virtualisation layer, as well as managing the physical security of its data centres. Customers are responsible for identity and access management, patch management, firewall configuration and other network security measures.