Typically, in the shared responsibility model, the cloud provider is responsible for the security of the cloud, while the consumer of the cloud services is responsible for security in the cloud. Each cloud service provider (AWS, Azure, GCP, etc) defines shared responsibilities differently. Here are general outlines of the responsibility of the cloud provider as defined by three of the major cloud service providers:
AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run AWS Cloud services.
For GCP, Google is responsible for the cloud, i.e the infrastructure, physical security, network security (especially in Platform-as-a-service scenario), web application security and deployment (in Software-as-a-service models)
For Azure, security responsibilities vary depending on whether the workload is hosted on Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), or in an on-premises datacenter.