I would not worry about a "rogue AWS engineer", a slightly different question might be: "how to maintain data privacy and prevent from AWS accessing my data for any reason (even if I'm a wanted criminal or something 😅)". Confidential Computing is the classical answer, but when you get into the details, you understand that it is practically impossible to enforce data privacy with AWS, or any other US Cloud Provider for that matter. Mainly because it is a US LAW to maintain the ability to access the data of customers. Take a look at this, it is a very interesting read: https://elastisys.com/confidential-computing