<p>This is a defense in depth tactic.</p>
<p>There are other defense mechanisms in place at AWS to prevent data leakage such as disk destruction on disposal or limiting access to data centers to approved employees.  If those defense controls were to fail the encryption at rest would provide a layer of defense to prevent data leakage.</p>
<p>As you pointed out, access to your account provides access to the data.  The defense in depth for this attack surface is that you keep your access keys secure, rotate them every 90 days, and don't provide access where it isn't need.  Your user accounts should have strong passwords, no reuse, rotated every 90 days, the right access controls, and MFA enabled.  These are all defense in depth tactics to keep your environment secure.</p>
<p>In general, from a non-AWS perspective, data at rest encryption could be the only layer of data leakage protection.  Not everyone is SOC2/ISO27001/PCI/HIPAA compliant.</p>
<p>Bottom line, is data at rest encryption security theater? No.  Is it the first line of defense? No (in the case of AWS).  Is it part of a broader security defense in depth strategy?  Yes.</p>
<p>References:<br />
<a href="https://csrc.nist.gov/glossary/term/defense_in_depth" rel="nofollow noreferrer">Defense in Depth Definition</a><br />
<a href="https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/defense-in-depth" rel="nofollow noreferrer">Defense in Depth</a></p>

CC BY-SA 4.0
2022-02-01T18:51:41.003Z
2022-02-01T18:51:41.003Z
kenlukas
<p>AWS <a href="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html" rel="nofollow noreferrer">offers at rest encryption</a> for its RDS instances. I think this <em>sounds</em> nice, and it's something that comes up regularly on security reviews but I'm not sure what the real benefit is. The most likely way someone will get access to my database is via my AWS account, which would nullify any benefits of KMS (unless it happens to be a user without access to that KMS key and without authorization to grant that access). In what realistic scenarios does this protect my company?</p>
<p>A similar question was asked several years ago over on <a href="https://www.reddit.com/r/aws/comments/8jdqt9/real_world_benefits_of_rds_encryption_at_rest/" rel="nofollow noreferrer">Reddit</a>, with this response:</p>
<blockquote>
<p>I've always understood it that this (and S3 encryption, etc) are
mostly security theater. If a rogue Amazon employee grabbed a bunch of
disks out of the racks and stole them, encryption would save you in
this case. But it's unlikely for this scenario to ever happen, and
even if it did, data is probably sharded across a bunch of physical
disks and who knows if that employee would even get usable data even
without encryption.</p>
<p>But in the real world, HIPAA, PCI, or some other such compliance
standard frequently requires that you use this, whether it's security
theater or not. So you just enable it and move on with life.</p>
</blockquote>
<p>I'm wondering if there are more updated views on this outside of marketing statements and regulatory/compliance concerns.</p>

<amazon-web-services><security><amazon-rds><encryption>
What are the real world benefits of RDS instance (at rest) encryption?
MrDuk
# What are the real world benefits of RDS instance (at rest) encryption?

(Asked by: username_0 on 2021-10-04)

AWS [offers at rest encryption](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html) for its RDS instances. I think this *sounds* nice, and it's something that comes up regularly on security reviews but I'm not sure what the real benefit is. The most likely way someone will get access to my database is via my AWS account, which would nullify any benefits of KMS (unless it happens to be a user without access to that KMS key and without authorization to grant that access). In what realistic scenarios does this protect my company?

A similar question was asked several years ago over on [Reddit](https://www.reddit.com/r/aws/comments/8jdqt9/real_world_benefits_of_rds_encryption_at_rest/), with this response:

> I've always understood it that this (and S3 encryption, etc) are
> mostly security theater. If a rogue Amazon employee grabbed a bunch of
> disks out of the racks and stole them, encryption would save you in
> this case. But it's unlikely for this scenario to ever happen, and
> even if it did, data is probably sharded across a bunch of physical
> disks and who knows if that employee would even get usable data even
> without encryption.
>
> But in the real world, HIPAA, PCI, or some other such compliance
> standard frequently requires that you use this, whether it's security
> theater or not. So you just enable it and move on with life.

I'm wondering if there are more updated views on this outside of marketing statements and regulatory/compliance concerns.

**Tags:** amazon-web-services, security, amazon-rds, encryption


---

## 1 answers

### Answer by username_1 on 2022-02-01. Score: 1

This is a defense in depth tactic.

There are other defense mechanisms in place at AWS to prevent data leakage such as disk destruction on disposal or limiting access to data centers to approved employees. If those defense controls were to fail the encryption at rest would provide a layer of defense to prevent data leakage.

As you pointed out, access to your account provides access to the data. The defense in depth for this attack surface is that you keep your access keys secure, rotate them every 90 days, and don't provide access where it isn't need. Your user accounts should have strong passwords, no reuse, rotated every 90 days, the right access controls, and MFA enabled. These are all defense in depth tactics to keep your environment secure.

In general, from a non-AWS perspective, data at rest encryption could be the only layer of data leakage protection. Not everyone is SOC2/ISO27001/PCI/HIPAA compliant.

Bottom line, is data at rest encryption security theater? No. Is it the first line of defense? No (in the case of AWS). Is it part of a broader security defense in depth strategy? Yes.

References:  
[Defense in Depth Definition](https://csrc.nist.gov/glossary/term/defense_in_depth)  
[Defense in Depth](https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/defense-in-depth)


---

