AWS keeps most AMIs current with operating system patches, once you deploy / run an EC2 instance on AWS, it is the customer, who keeps the system patched with tools like Amazon EC2 Patch Manager.
You need to turn on Amazon EC2 Patch Manager on and configure it to keep your Amazon EC2 instance sets patched.
More from LonzoDB on AWS