Reading into the various SSE options on S3, I'm can't understand the following:
What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against?
I can only think of a physical attack vector, where someone physically gets the HDDs used for S3 storage. In that case, why is this encryption optional? Shouldn't it be a mandatory default, handled by AWS entirely for their own purposes?
In other words, what are the attack vectors that this particular solution helps to mitigate?