I feel like you've narrowed the original statement ("You have no secrets from the person who owns your hardware") when you scope it to just data storage at rest

I feel like you've narrowed the original statement ("You have no secrets from the person who owns your hardware") when you scope it to just data storage at rest. I take hardware to mean significantly more than just at rest data storage in the context that it was used. If your unencrypted data flows through any AWS memory or compute, or if your encryption key flows through any AWS memory or compute, then AWS *can* access that data.