Update responsibility for AWS Storage Gateway

Customer is testing the AWS Storage Gateway for Files on EC2.

Is the customer responsible to keep the OS of the EC2 instance up to date or do we take over that part of the shared responsibility model?

My understanding: The customer can set the maintenance window or trigger the updates manually, but AWS is responsible to keep the Storage Gateway on Amazon EC2 up-to-date, correct?