This sums it up, "The convention of using a cloud platform is to use a cloud platform".

If you rent compute space, then you trust them to responsibly use the hypervisor instead of snooping. If you trust that or not, you are all in and may as well cement over the external port 22.