IANAL, but you are still responsible for it if you host it on a cloud server, the difference is mainly that the authorities will complain first with your cloud host, which will likely take down the entire site, instead of with you directly who can swiftly remove the offending material if asked to do so.

It is FUD to say the police will SWAT you if someone reports CSAM on your server. But you should have an easy way for the responsible agencies to contact you for take-down requests.

For people hosting in the EU, this pdf document explains the legal situation a bit and also where and how to report CSAM, should you come across it.