Not quite. If it works like the Thalès / Google S3NS thing, then Amazon employees have no access at all to the EU infra, and any software updates Amazon needs to make can only be delivered to a quarantine environment from which then can only be passed on to prod by EU, non-Amazon employees, after validation.

That's in line with the requirements laid down by the ANSSI (French govt security agency), and those are tight. Believe it or not, they are not stupid.

> That way Amazon can honestly say it has no operational control to violate EU law because there's no American employee they can command.

> Amazon is intentionally setting it up in a way that it won't be able to do anything about that.

They can say whatever they want but when the NSA knocks on the door, they'll covertly implant a backdoor anywhere they ask and ship the update to the "sovereign" EU cloud. This is nothing but a ruse.

> Operational control isn't all-or-nothing.

When the US government has no issue asking a company to hand over its tls keys, it really is.

Or they’re attempting to ‘green wash’ something that US parent can definitely actually control, so they have some plausible deniability. It is not even close to the first time something like that has occurred.