You have the same obligation with an EC2 AMI that you have with a physical server.

Using a cloud/vps/whatever provider does not obviate the need to secure the base OS.

Using virtualized hardware does expose you to vulnerabilities in the virtualization layer, though...