AWS/GCP/Azure Cloud turns the audit beast into a house-cat: one IAM rule, one log stream, one firewall and etc. Otherwise, you need to fill out a lot of documents to prove that your bare metal is safe to host, for example, cardholder data.