One can publish a public key in the open

Any number of folks can encrypt messages and send it to the private owner

Clients cannot see or decipher each others messages

Only the owner can see the messages

it is like a lock box that any one can drop stuff, only the owner can open it

Like access to a linux box

If the private key you provide opens a public key encrypted message on that linux box, then the box is yours

so public key is held by aws on that linux box

then the private key can be tested to see if it matches the public key

Only one private key can match that public key and so access is granted