Most of how the NSA operates is classified but this does not sound far-fetched to me in the slightest. Cloud providers frequently provide law enforcement information via subpoena. It's not really "breaking in."

From 2015, AWS asserted they were not involved in the PRISM program, but they would be under a gag order if they were, so you've gotta take it with a grain of salt: https://www.crn.com/news/cloud/300077146/aws-finally-release...

Meanwhile:

> From the start of this calendar year through May, AWS received 813 subpoenas from the U.S. government seeking access to customer accounts. In those five months, the Seattle-based cloud provider fully complied with 542 of those court orders, submitted partial information in response to 126 and didn't respond at all to 145.

> Through the same period, Amazon received 25 search warrants from federal authorities and turned over all the data sought by about half of them, partially fulfilled eight others and withheld information requested by four of the warrants.

> AWS fully responded to only four out of 13 court orders that weren't subpoenas or warrants, while refusing to turn over any data related to four of those.

> Foreign governments were more successful with their solicitations to Amazon. Of the 132 non-U.S. requests fielded by the cloud provider, more than 80 percent yielded complete data disclosures, while just 13 percent hit a dead end. Amazon also complied with the only request it received during the five months under review to actually remove a user's data from its servers.