Are you the Data Owner? Then it's largely your problem.
The cloud supplier is a data processor certainly and has some responsibility but where the configuration of the cloud service is down to you then that problem comes all the way back to you, the data owner.
Where is gets cloudy {many lols :-| ) is that vendors like to imply they give your data complete security and that they are complety solid on providing you a platform to host PII data. Which is true IF you buy the right services and configure them correctly.
If you buy the cheapest no frills option and stick it in vanilla, you'll get nailed and the cloud vendor is not going to step up and take the blame for you.