Lets say I want to run a out-of-the-box instance on Amazon EC2 and on my own standalone server. I don't run anything on them, just let them idle by themselves. What is the relative level of security offered by Amazon in that situation in comparison to a standalone server (say, if someone wanted to brake into those servers and install some malware on them)? What attack types are less likely to be successful?
They are relatively similar and there is nothing special about an Amazon EC2 server that you can not achieve at home.
However, the two defaults that won't occur (by default) in an ordinary install of, say, CentOS are:
Of course, there is a clear security negative with the EC2 cloud:
There are other advantages of EC2 over, say, keeping the server in your bedroom. But these apply more generally to data center vs. bedroom:
I would consider an EC2 image equally secure to its corresponding common operating system. If I run the same image on my home machine and on EC2, they present the same security profile. There's nothing magically different in the security of a VM versus running directly on hardware.