I'm trying to find this specific information but having a hard time, so I'd like to ask you guys.

How should I interpret the open ports that you can see on Shodan for an IP belonging to amazon/microsoft/etc cloud services?
I know with shared hosting you have different domains on the same IP, but who manages the ports? Are they the default that the provider allows? Are they ports that maybe one of the hosted domains opened for themselves?
I knew that when seeing open ports on an IP on a cloud service, for example when doing a vulnerability assessment, it doesn't mean that they're actually open for the interested domain. Was I mistaken? I'd like to clarify this thing in my mind!
Thanks