I'm guessing so they can keep data of EU customers stored within the EU.

You can do that with AWS regions though.

The US government can still get at that data, because Amazon is still an American company. It doesn’t matter where the data actually lives.

There's published proof the US government actively will go to the extent of having submarines go to undersea fiber cables to tap into them. They have private lockers in almost all the datacenters in the world, etc. Doesn't matter if it's an American company or not.

There are potholes and drunk drivers on road. It does not matter if you use seatbelt or not.

Yes it does matter is the company is subject to US law or not. There is not 100% security but saying “it does not matter” is manichean and does not reflect reality. Yes the US have a very long arm but it’s all a cost/benefit even for three letter agencies.

Every time they make use of a zero day or a backdoor they run the risk of it being discovered. The harder it is to get a new one, the more they will think twice about using it for mass and low stakes surveillance. A non-US company will be less inclined/forced to cooperate with them, making it harder for them to siphon data out, hence lowering probability.

No one is 100% safe, agreed though. Probabilities and threat models is all we got.

The US government can (and for many years did) tap the phone calls of the German chancellor; I don't think getting to data held by European cloud providers is really a big challenge for them.

Regarding the tech aspect? no. But legally it's always has been challenging. And that's where the difference lies

Unrelated, I think this also happens the other way around.

Meaning this is about EVERY manager being able to say "this is not my fault", not about any actual result? Literally every last one?

Sounds about right ...

As far as I know, the companies / service providers would love to be able tell their customers that 100% of their data is only stored and processed in the EU. It makes everything GDPR-related simpler for companies, and could be turned into a good advertisement for consumers.

The main benefit of using a 100% European cloud is to be 100% GDPR compliant. No matter how you slice it and how lawyers/companies try to wiggle around it, it's not possible to host data with a US company and be GDPR compliant, because of US laws.

Customers do ask about it, and it's always iffy to have to justify your GDPR compliance when using US cloud companies.

Which is why the big cloud providers have European data centers that comply with all relevant European laws where many big European companies, including some banks, medical companies, etc. choose to host their stuff. You know, the type of companies that would actually care a lot about such things and let their lawyers make sure they are doing all the right things.

AWS actually joined Gaia-x years ago. I think MS and Google did as well. They want to be compliant. Keeping their European customers happy is important to them. They use European legal entities as well to do business here. Because that is indeed required. No need to switch cloud provider. Just make sure you use them correctly and do all the right things. Which in any case is 100% your responsibility as you will be on the spot if you get that wrong. This job doesn't change if you switch cloud provider.