According to the AWS Shared Responsibility Model, the customer is responsible for "security in the Cloud." This includes configuring and managing network controls to protect their resources. Tasks such as creating and managing security groups (virtual firewalls for EC2 instances) and network access control lists (NACLs) for subnets fall under the customer's responsibility. These configurations dictate the inbound and outbound traffic rules for the customer's environment within the AWS Cloud.

A. Maintaining the security of the Cloud, which encompasses the hardware, software, networking, and facilities that run AWS services, is AWS's responsibility.
C. Amazon RDS is a managed service. AWS is responsible for patching the database engine and the underlying operating system of the RDS instances.
D. AWS is responsible for managing and controlling the physical data centers, including all physical security and environmental controls for the global infrastructure.

1. AWS Documentation, "Shared Responsibility Model." AWS states, "Customers are responsible for managing their data... and using IAM tools to apply the appropriate permissions." The model further clarifies that for Infrastructure as a Service (IaaS), the customer is responsible for "Network and firewall configuration." This directly supports option B. AWS's responsibility is for the "AWS Global Infrastructure," which covers options A and D.

2. AWS Whitepaper, "AWS Security Pillar - AWS Well-Architected Framework," (July 2023). Page 6, under the section "Shared Responsibility Model," states: "For IaaS services, such as Amazon EC2, AWS provides and manages the security of the infrastructure... You are responsible for the security of the guest operating system... and configuration of the AWS-provided network firewall (called a security group)." This explicitly assigns firewall configuration to the customer.

3. Amazon RDS User Guide, "Amazon RDS features - Security." The documentation states, "AWS is responsible for the security of the cloud... For Amazon RDS, this means that AWS manages the security of the infrastructure layer, the operating system, and the database engine." This confirms that OS patching for RDS (Option C) is an AWS responsibility.