Are you saying that AWS is peeking inside the VM you’ve deployed?
Amazon have very expensive lawyers, I'm sure that their T&Cs are flexible and woolly enough to include some reasonable justification for doing whatever they please with your VM.
"in order to secure our service against abuse..."
"in response to a court order..."
"...in order to provide better service, we reserve the right to."
https://aws.amazon.com/service-terms/
96. AWS Nitro System
AWS personnel do not have access to Your Content on AWS Nitro System EC2 instances. There are no technical means or APIs available to AWS personnel to read, copy, extract, modify, or otherwise access Your Content on an AWS Nitro System EC2 instance or encrypted-EBS volume attached to an AWS Nitro System EC2 instance. Access to AWS Nitro System EC2 instance APIs – which enable AWS personnel to operate the system without access to Your Content - is always logged, and always requires authentication and authorization. /quote
This has been third party validated (there's a blog) and is part of the contract terms. Which you would find if you did any research before posting. I'll let you figure out how you don't understand KMS either.
Good for them, if it's really the case that they can't read Nitro EC2 instances. Of course, that still leaves S3, RDS, DynamoDB, Elasticache...