Amazon's S3 storage service offers server-side encryption of objects, automatically managed for the user (Amazon's Documentation). It's easy to enable so I'm thinking "why not?", but what kind of security does this really provide?

I guess it prevents someone from wandering into the AWS datacenter and grabbing a hard drive, but that seems very unlikely, and presumably anyone with access like that could also get the AES keys, wherever they're stored.

It doesn't seem to protect the data once it's off the drives, since at that point it's decrypted, and anyone who has your credentials or can intercept the traffic will see the data in the clear. So what's the point, really? Just to say the data is "encrypted"?

The short answer is this: We have no idea, probably none.

It might protect against stolen backups. But that assumes Amazon even makes backups. That seems very unlikely. If they did, why couldn't they recover data from their last S3 data loss? It's much cheaper and more efficient just to use multiple live copies.

Also, Amazon would need the keys on every access. So it seems very unlikely that they store the keys anywhere other than approximately the same places they store the data. So if you're  imagining a theft of live data devices, it's just as likely that they get the keys as well.

But we don't know how Amazon stores, replicates, and/or backs up data. Nor do we know where they store the keys or how they distribute them. However, I've yet to hear a plausible argument that there exists a realistic threat they protect against. The "stolen backups" theory seems to be based on the false premise that Amazon uses backups when all the evidence suggests they use multiple, live copies with the keys quite nearby.

Dropbox's encryption, however, does protect against one real threat model, albeit a very unlikely one. Dropbox stores their own keys and sends them to you, so it does protect you from a rogue Amazon employee. In exchange, you're vulnerable to a rogue Dropbox employee or Dropbox security bug.

My own opinion is that Amazon added this feature just so they could say that data could be stored encrypted. Some people will mindlessly compare check boxes on feature lists and Amazon wanted a check box on the "secure/encrypted" line. Either way, the weakest link is most likely Amazon's internal network and human security and the validity of the implementation of the code that decides whether to permit accesses or not.
