Amazon does have a Type II SAS 70 report. Requesting a detailed copy of that should show all the controls they have in place. It may that people are asking Amazon the wrong questions. As a quick note, the SAS 70 testing in the future will be referred to as an SOC -- one of those accounting industry quirks.
Especially with an Amazon-sized company, one looks at the report, sees that it is reasonable, and declares that they have done due-diligence. In very vague terms, Amazon and their PCI auditor then have some sort of fiduciary duty in the case of a whoopsie-daisy on their part.
Update: The relevant control objective for you as a client is this: 2.4 Hosting providers must protect
each entity’s hosted environment and
data. These providers must meet
specific requirements as detailed in
Appendix A: “PCI DSS Applicability for
At least in my interpretation, Amazon principally has to deal with the four controls specified in A.1. There are many others that don't matter, and some that do. I don't know what your auditor is able to get, but as I understand without documentation in front of me: Amazon has passed without remark. That means they have been independently reviewed to meet all those objectives. With that in mind, the rest of the burden is on your company to meet everything else that's relevant to what is inside the instance.
Auditors aren't always right. You may find it worthwhile to engage another auditor. You may find I'm wrong (though I'm confident I've got this). At least you don't have this: http://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants