Having taken a large organization's entire stack the other way in 2016 - from dedicated metal colocation to AWS, after a series of devastating ddos attacks on our datacenter - I've remained cautious and judicious in how I use cloud services, to attempt to prevent lock-in, for this reason. I build all critical systems (including outbound mail - which requires negotiating with Amazon) on raw EC2 VMs, allocated drives and RDS images, and more or less balance workloads between them manually. This involves a bit more hassle than e.g. putting frontends on elastic beanstalk with automatic load balancing, or using buckets or any of the nicer cloud features... I basically treat AWS as a colocation facility where I don't need to get anyone on the phone to reboot a machine at 3am. I've been told I'm "misusing" or even "misunderstanding the purpose of" the wonderful services provided by AWS. But for me, the upshot is that I could probably port the entire infrastructure to any other server farm within a few hours if necessary.