"Obfuscating commands" isn't a thing. EU employees know if they are retrieving data or not. And they don't blindly run commands like they're dummies or something.

And if they fly American employees over, what makes you think they'd be let in the building, or under what credentials do you think they'd be accessing the system? Legally speaking, those Americans are simply from a partner company. Just because you're doing business with a partner company doesn't mean you let them into your building.

The point is that AWS is intentionally making it so they don't have options.

So yes, US law lets it go. The law is limited in terms of what it can affect outside US borders. If the EU doesn't want to cooperate, and the US isn't willing to engage in sanctions or war against the EU, then yeah the US is out of options.