In that case Amazon's wording would be pretty disingenuous - "AWS customers' data and instances are not affected by these issues" when the reality is more like "as far as we know nobody exploited this before we patched"?
Good point. In theory, they could have had other mitigations in place for this class of vulnerability, which they chose not to share with the GPL Xen community.
It depends on the version of Xen they are running. XSA-148 only affects Xen 3.4 and newer. If AWS is running an older version of Xen, they may never have been affected.
Since Amazon don't tell anyone about what they run, and don't release back to the broader Xen community, I guess we'll never know.
Right, "AWS customers' data and instances _ARE_ not affected" (emphasis mine) does not imply "AWS customers' data and instances _WERE_ not affected"
Breaches are a one-way state change, like death. If customer data WAS affected, then it IS affected, until customers take action such as disclosure, resetting passwords/keys, etc. If customer data was affected, AWS would need to advise customers to take remedial steps. Since they have not issued such advice, is it safe to assume that they had mitigation in place for this attack?
It could also be the case that they have monitoring systems on the host machines that would have reliably detected this issue being exploited, even before this specific vulnerability was discovered (or perhaps better to say, given the age of the bug, before being discovered by someone that disclosed it to Xen).