Technically, you can probably ship something based on pure AOSP, but your competitors will have had pre-AOSP access to the code for multiple months and there are no guarantees that AOSP even works without Google's magic proprietary mojo. CyanogenMod had to develop the missing pieces when Google sent their C&D over the proprietary bits. I would suspect defensive things designed to make it more difficult for Amazon to leech AOSP are either present or coming soon particularly with the rumors that Amazon is working toward introducing a phone.