Spoiler: They are. AWS and Amazon both used Log4j exploitable from the homepage (/) of both sites through headers.

Source: me