We managed it ourselves. My opinion is, if you have a clear infrastructure defined, like migrate from on-premises to the cloud, it makes sense to use their predefined infrastructure (not sure if there is a price difference). If you are still in the ideation stage, not clear what to build yet, just follow the best practices when you create new components (https://github.com/aws-quickstart/quickstart-compliance-hipa...), you can sign a BAA from aws artifact for your account.