Only some parts of AWS are DoD certified, and even then only some services in the GovCloud region (which isn't widely available) are fully certified. It's entirely possible some contractor made use of a service which isn't certified still.