They actually get around SNI blocks (or did, I'm not sure if anymore) with a technique called "domain fronting". If I recall correctly, AWS wasn't so happy about it when it was bought to their attention and they were asked to stop. There was even some discussion on HN about it. Not exactly sure what the current state is.