Yep, it's possible, but to get them to sign a BAA with you, you need to agree to only use a very small subset of the AWS products (basically just EC2 and S3. No RDS, no ELB, etc.). Additionally, any EC2 instance you provision need to have the "single tenancy" bit set on your instances. Which, when set, you start getting hit with a very high flat per-day "single tenancy" fee in addition to higher hourly costs for your instances.
Correct! Once you need single tenancy, you might as well be buying your own gear and colo'ing it (unless you have a desperate need for low latency access to other AWS services you simply can't move away from).
