An EC2 instance is a virtual machine. PHP2Shell follows whatever PHP package or container that instance runs. AWS does not patch the guest PHP for you.
Identify the runtime
Use the distribution guide that matches /etc/os-release. Also check user data and AMI bake pipelines that may reinstall an old PHP on the next boot.
Change and verify
Patch with the vendor package, restart the SAPI, and bake a new AMI if you use autoscaling. Otherwise a scale-out event launches the old image and puts the CVE back. This review did not confirm an Amazon Linux package version. Check Amazon’s advisory for AL2 or AL2023 before you quote one.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.