What are the real world benefits of RDS instance (at rest) encryption?

Question

AWS offers at rest encryption for its RDS instances. I think this sounds nice, and it's something that comes up regularly on security reviews but I'm not sure what the real benefit is. The most likely way someone will get access to my database is via my AWS account, which would nullify any benefits of KMS (unless it happens to be a user without access to that KMS key and without authorization to grant that access). In what realistic scenarios does this protect my company?

A similar question was asked several years ago over on Reddit, with this response:

I've always understood it that this (and S3 encryption, etc) are mostly security theater. If a rogue Amazon employee grabbed a bunch of disks out of the racks and stole them, encryption would save you in this case. But it's unlikely for this scenario to ever happen, and even if it did, data is probably sharded across a bunch of physical disks and who knows if that employee would even get usable data even without encryption.

But in the real world, HIPAA, PCI, or some other such compliance standard frequently requires that you use this, whether it's security theater or not. So you just enable it and move on with life.

I'm wondering if there are more updated views on this outside of marketing statements and regulatory/compliance concerns.

Answer 1

This is a defense in depth tactic.

There are other defense mechanisms in place at AWS to prevent data leakage such as disk destruction on disposal or limiting access to data centers to approved employees. If those defense controls were to fail the encryption at rest would provide a layer of defense to prevent data leakage.

As you pointed out, access to your account provides access to the data. The defense in depth for this attack surface is that you keep your access keys secure, rotate them every 90 days, and don't provide access where it isn't need. Your user accounts should have strong passwords, no reuse, rotated every 90 days, the right access controls, and MFA enabled. These are all defense in depth tactics to keep your environment secure.

In general, from a non-AWS perspective, data at rest encryption could be the only layer of data leakage protection. Not everyone is SOC2/ISO27001/PCI/HIPAA compliant.

Bottom line, is data at rest encryption security theater? No. Is it the first line of defense? No (in the case of AWS). Is it part of a broader security defense in depth strategy? Yes.

References:
Defense in Depth Definition
Defense in Depth