Curious, how do services like this stay compliant with export controls on these devices? I assume a credit card is all I need to access these things?

They do not export devices, they export services.

Precisely. BIS does not consider cloud compute services to be exports.

There are some rules around when you knowingly know that a customer is military or WMD, and you obviously can’t supply services to someone on the entity list; but KYC-through-credit card kinda works at small scale.