Regarding the people that died on October 7, one important detail is evidence surfaced it appears a sizeable fraction was killed due to Israeli military attacking militants and hostages without distinction, to avoid capture, following the so called Hannibal directive:

https://thecradle.co/articles/israeli-army-ordered-mass-hann...

https://thegrayzone.com/2023/11/25/israels-october-7-propaga...

https://en.m.wikipedia.org/wiki/Hannibal_Directive

Assuming for a moment that AWS's security at all matches the public API.

There are two ways to grant access to a KMS key: as a policy grant on a user/role, and as a policy on the KMS key itself.

If you don't have access to the key, then reading the S3 object doesn't work.

So I have to trust that AWS's security here is that the S3 API itself can't unless granted that access.