I feel like you've narrowed the original statement ("You have no secrets from the person who owns your hardware") when you scope it to just data storage at rest. I take hardware to mean significantly more than just at rest data storage in the context that it was used.

If your unencrypted data flows through any AWS memory or compute, or if your encryption key flows through any AWS memory or compute, then AWS *can* access that data.

> It was never safe for any government to move any secrets to any cloud.

does this not refer to moving data?

I don’t think it refers solely to data at rest, no.

Thats not fool proof what so ever.

It's as fool proof as you can get though.

If your data is well encrypted they practically don't have any access to any of the information except how much of it there is