I assume they mean by default, employees do not have access to the KMS key necessary to decrypt the sensitive data. (They mention using an individual KMS key per customer)
I suspect there must be a handful of SREs who, who could access it if they really wanted to - though that access would still be logged in cloudtrail.
I suspect there must be a handful of SREs who, who could access it if they really wanted to - though that access would still be logged in cloudtrail.