As in my other comment, they are using an old version of Nginx.

My point is more general than that specific stack, the concept of one click deployment stacks which are built by Sys-Admins and have support is a big deal.

As is mine. This is a great move by Amazon, but there is a huge security risk if the community doesn't squeeze out bad practice.