In the Infrastructure as a Service (IaaS) shared responsibility model, the Cloud Service Provider (CSP) is typically responsible for securing the physical infrastructure, which includes the physical security of data centers, servers, networking hardware, and the physical security controls that protect them from unauthorized access or damage.
Encrypting data at rest is typically the responsibility of the consumer, though the CSP may offer tools to help with this. Managing application code is the responsibility of the consumer, as they control and deploy the applications onthe infrastructure provided by the CSP. Configuring firewall rules is also the responsibility of the consumer, as they manage the configuration of the virtual network, including security rules like firewalls.