How to stop an AWS back-end hack?

I've been mortified by reports of Facebook, Clubhouse and LinkedIn being hacked. My question is simple, I have a iOS app that communicates with a AWS backend. We store data in S3 buckets, we use Lambda functions, we use SHA256 encryption going back and forth, we use strong passwords everywhere, we do all the stuff we know to do.

What else should we do and who can help us?