AWS offers at rest encryption for its RDS instances. I think this sounds nice, and it's something that comes up regularly on security reviews but I'm not sure what the real benefit is. The most likely way someone will get access to my database is via my AWS account, which would nullify any benefits of KMS (unless it happens to be a user without access to that KMS key and without authorization to grant that access). In what realistic scenarios does this protect my company?
A similar question was asked several years ago over on Reddit, with this response:
I've always understood it that this (and S3 encryption, etc) are mostly security theater. If a rogue Amazon employee grabbed a bunch of disks out of the racks and stole them, encryption would save you in this case. But it's unlikely for this scenario to ever happen, and even if it did, data is probably sharded across a bunch of physical disks and who knows if that employee would even get usable data even without encryption.
But in the real world, HIPAA, PCI, or some other such compliance standard frequently requires that you use this, whether it's security theater or not. So you just enable it and move on with life.
I'm wondering if there are more updated views on this outside of marketing statements and regulatory/compliance concerns.