Moving to the cloud does not hand all security to the provider, so you need to know exactly where your part starts. AWS secures the hardware and data centres, while you secure your data, access and configuration, and the line moves with the service: you patch the OS on EC2, AWS does it on RDS. Most real cloud leaks are customer mistakes like a public S3 bucket, not provider hacks. This is a common opening question in cloud interviews.