AWS operates the underlying facilities and infrastructure. You still control how your account uses them. The dividing line changes by service: EC2 leaves you responsible for the guest operating system, while a managed database removes many infrastructure chores but still needs suitable access, backups, and data handling.
A service choice starts with the workload. An object store, a relational database, and a queue solve different problems. Buying a managed service doesn't automatically make data public or private, prove a recovery plan, or remove the need for application security. In these scenarios, identify the thing being protected or operated, then choose the owner or service that matches that responsibility.