That's awesome. I'm guessing it's limited to software Amazon themselves develops and doesn't extend to software deployed to AWS?
How could it? AWS will happily run whatever code you want, using whatever good or bad development practices you care to choose.
Fair. More just wondering if that have any sort of process for investigating data breaches involving software hosted on their servers.
Look at the “shared responsibility model” - if someone got in through the host then I guess they’d investigate. If you leak your SSH private key it’s on you.
http://nickfoy.com/blog/2018/4/7/good-intentions-dont-work
For example, if an admin bungles a copy/paste shell command and it causes an outage, instead of punishing the admin for not wanting hard enough to do it correctly, they'll change the process so it doesn't rely on admins copy/pasting shell commands.