Kernel updates are a bit special, as they have their version in the package name and you can therefore have multiple versions installed at the same time. So actually when you update your kernel, you install a new, different kernel package. Some time later the old kernel package can be removed. It's not an in-place upgrade like for most other packages.
This is achieved by having metapackages (basically an empty package that just has dependencies, no actual files) which always depend on the latest real kernel version package. In your case, that would be
During a kernel update, this metapackage is getting updated to a version which has different dependencies. That way the package manager is told to additionally newly install the latest real kernel package.
So knowing this all and that
apt-mark hold prevents a package from getting updated, you can see that
apt-mark hold linux-image-4.15.0-1007-aws will not prevent you from getting kernel updates, as that specific real kernel version package will not be updated. The metapackage
linux-image-aws will be updated instead, causing a new kernel package to be installed.
Therefore you would have to instead run:
sudo apt-mark hold linux-image-aws
However, be advised that ignoring kernel updates (or updates to any other package) can make your system vulnerable to known security issues which would already be fixed in the latest version. You should keep your systems up to date and secure.