The key is stored in KMS, not on the drive firmware. You can read more about how this is done here, in the section at the bottom about "Isolation of Physical Hosts"
https://docs.aws.amazon.com/kms/latest/developerguide/concep...But in short, the key is kept in memory on the HSM, and employees don't have access to it. They key can be referenced, but not actually read.
It also means that if a user accidentally deletes their key, there's no recovery. That's it. (Pro tip: Deleting a key is a faster mechanism to make data unreadable than deleting the data itself. ;)
Disclaimer: I'm an S-TAM with AWS.
