[lusis]

You have the same obligation with an EC2 AMI that you have with a physical server.

Using a cloud/vps/whatever provider does not obviate the need to secure the base OS.

[cperciva]

Using virtualized hardware does expose you to vulnerabilities in the virtualization layer, though...