Well, for starters they wouldn't be able to claim HIPAA or PCI-DSS compliance anymore. Anyone dealing with health information of Americans would expose themsel

Well, for starters they wouldn't be able to claim HIPAA or PCI-DSS compliance anymore. Anyone dealing with health information of Americans would expose themselves to criminal charges if they ever use AWS again. Though it's a private sector response, Visa/MasterCard/etc would also push anyone dealing with credit card numbers off of AWS. At least PCI-DSS certification (I don't know about HIPAA) further involves annual audits to make sure that certain proactive things are being done as well, specifically including things like data access logs. Those audits aren't as comprehensive as they ought to be, but they'd catch something egregious like marketing people looking into data owned by AWS customers. I'm pretty sure (though much less than the above) that this would also be a de facto GDPR violation, meaning that nobody who wants to do business in Europe could safely use AWS anymore either. Amazon itself uses AWS and wants to do business in Europe, so that's a pretty good incentive.