The article is vague (no link to docs, no formula, no block diagram), but it seems to say the fundamental process still runs via a pre-shared-secret. That is secret you're trying to secure, and one that AWS knows.

However, that secret is no longer used for the signing. Instead it's combined with a date and service-description to generate a public-private keypair, which is itself not secret (both AWS and you can derive this if you know the algorithm). Your requests are now signed with this private key (client side) and can be verified by the services with the public key (server side).

AWS still knows your secret, but it keeps it in a more secured location verses out on the farms. The farms would need a way to request your public key for the day from the secured location, so they can verify the sender. But, the farms no longer have access to your secret key, so cannot sign other requests masquerading as you.