The last time I've checked the draft, it looked like MySQL project would be responsible if a security bug occurs and responsible to do certification, because they provide paid support. But Amazon could just host MySQL without spending anything on dev or certification of MySQL codebase (because MySQL would be forced to do certification because they do make money with their code by providing the paid support).