AWS Certified Cloud Practitioner

A company stores confidential documents in S3. A security audit found the S3 bucket is publicly accessible. According to AWS Shared Responsibility Model, who is responsible for this misconfiguration?