If you care about this, you can use Shamir Secret Sharing to require two (or more) keys to recover the encrypted file. So even if AWS was malicious, they still wouldn't be able to get the file without your other key (presumably a GPG or GCP KMS key)