AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a malicious certificate on the device's certificate store. However, if an app is instructed to trust all certificates signed by AWS, couldn't an attacker trivially buy a malicious cert from AWS and install that in order to pull off a MITM?
TL;DR: No. That's not how certificates or pinning work.
All certificate pinning does is limit the root of the trust chain to a smaller set, for a specific domain. It doesn't change how the certificates work. It only adds a new constraint on acceptable roots, without disabling any others, and they all have to match -- domain name, date, etc., and now pinned root.
The only way a MITM like you describe could occur is if someone managed to get a certificate, through Amazon, of your domain. Such a thing is technically possible, of course, because people run the systems and people are fallible. However, if anything, pinning a cert makes that attack harder. Without it, they could attack any trusted root certificate. With cert pinning, they have to attack the one(s) you've pinned.
That's not what pinning is. Your phone already trusts a CA root that Amazon control, that is why AWS ACM can generate certificates that everyone's phone will accept. Pinning means telling your TLS client in your app to not just accept a certificate for the domain signed by any root trusted by the OS on the phone, but only a certificate for the domain signed by a particular CA.