AWS provides the ability to encrypt EBS volumes, the value of which I am wondering about. In the "Overview of Security Processes (October 2016)" whitepaper, page 24, they say:
Encryption of sensitive data is generally a good security practice, and AWS provides the ability to encrypt EBS volumes and their snapshots with AES-256. The encryption occurs on the servers that host the EC2 instances, providing encryption of data as it moves between EC2 instances and EBS storage.
So what is the threat model there? Whom the feature is supposed to protect data from? Bad guys who may get physical access to the EBS server racks and try to scan/analyze/extract the data they need from the myriads of physical disks?
Or, maybe, from AWS admins who have access to the host machines, have control over the RAM and hypervisor where encryption happens and can potentially access the unencrypted data anyway?