For me, that would be most probably both if I were serious. Less of a target of course (I'm only one dude), but also much less attack surface. Basically install a trusty GNU/Linux or Open BSD, set up automatic updates, and block everything but SSH. Oh, and disable password based logins —use a public/private key pair of appropriate strength.
Or better yet, ask actual security experts about that setup, they're likely to come up with something better (just as simple and more secure).
Exactly my thoughts and I'm not alone here. There is a growing attitude against cloud infrastructure which together with the industries hype for it will lead to a interesting clash at some point.
I hope this will bring out even more cloudless solutions in the future.
Or better yet, ask actual security experts about that setup, they're likely to come up with something better (just as simple and more secure).