> So I'm not so sure what's the point of encryption at rest in AWS except just to tick off a compliance and regulatory checklist.

> The private key is with them anyway, just don't encrypt and save few milliwatts of power.

"Them" is Amazon, a company with over 1 million employees, last I checked.

It's perfectly reasonable to trust the KMS team to keep your keys secure, even if you don't trust the RDS team to never try to look at your data.

I know it's tempting to think of all of AWS as a sort of "Dave" who wears multiple hats, but we're talking about a large company. Protecting against other parts of the same company is still a worthwhile and meaningful security control.