Also this. I mean they can easily touch the databases.
I’m not a system architect but expect it really depends on the setup. If they are using Bring Your Own Key (which they should be...) then it’s all encrypted and AWS doesn’t have the key.
BYOK is tricky to implement: If your keyserver blows up then your whole company is down. But yes, if implemented it will prevent the Govt or Amazon from getting your data. Of course they can start torturing your IT staff, but that is a different problem. It helps to have keys that explode if tampered with.
Fun stuff.