and even in the event they [cloud providers] found out it would be impossible for them to gather data on the users. The encryption key that is providing disk encryption on the VM instances would be accessible to the VM host. The VM host could also directly access the memory of the VM instances to read the disk cache, etc.
The host could potentially sniff the traffic during live operation by sniffing the memory of the vm.
But when the vm's communication is cut, the whole disk is encrypted. I expect this encryption to be done using some sort of public/private key encryption scheme, such that without the private key, you can't actually unencrypt the disk. THis is what is meant by gathering data on the user i suspect.