It’s possible to bring your own encryption to AWS. You can put an HSM you control on your own infrastructure and keep your keys there. As a step further you can encrypt before sending any data there in the first place, though you’re then operating more critical systems yourself, of course.