AWS is certainly large enough to have access to an embargoed update.
http://www.xenproject.org/security-policy.html