Github AMI Vulnerability Scanning

[nathanlederach]

I'm attempting to gauge the compliance of Github Enterprise Server 3.6 hosted in AWS. I cannot find any assurance from Github or AWS that the AMI is being scanned and updated based on any discovered vulnerabilities. I know that we cannot do this ourselves but I'm wondering if anyone knows how and how often it is being done by either Microsoft or AWS. Thanks