Also worth noting that not every resource and instance type is covered by a BAA so there’s a bit more to it than just signing an agreement and doing whatever you want.

The responsibility remains with the user rather than the cloud provider to ensure compliance but they will do their part if you set things up correctly.