Not quite. If it works like the Thalès / Google S3NS thing, then Amazon employees have no access at all to the EU infra, and any software updates Amazon needs to make can only be delivered to a quarantine environment from which then can only be passed on to prod by EU, non-Amazon employees, after validation.
That's in line with the requirements laid down by the ANSSI (French govt security agency), and those are tight. Believe it or not, they are not stupid.
A joint venture would work, indeed. There is still the possibility of a supply-chain attack, but it's still better than a subsidiary operating the system or hiring european employees.