I am just learning KMS and how granting encrypt/decrypt permissions on KMS keys works, but I don't understand what is the benefit of using KMS to encrypt data to send to another AWS customer, who then uses KMS to decrypt it -- when you could just use AWS infrastructure to send the data directly.
Conceptually what I understand is the following: Alice creates a KMS secret key, then uses KMS APIs to encrypt some data. Alice sends the encrypted data to Bob who is also an AWS customer, and Alice grants Bob "decrypt" permissions on that KMS key. Bob calls decrypt and passes the data and obtain the cleartext. Correct so far?
What I don't understand is how this could possibly be any more secure than Alice simply uploading the data and granting Bob read permission on it. In both cases, the first step is Alice uploading the data to AWS; in both cases, the last step is Bob downloading the data from AWS; and in both cases, the mechanism is only as good as AWS enforcing the permissions correctly.
And if Alice simply granted read permission on the data to Bob, that would abstract away all the details of creating and rotating encryption keys, handling encrypt/decrypt permissions, etc. and so the user would be less likely to make a mistake.
What am I missing? What is the benefit of using AWS KMS to share data between AWS customers, instead of just granting read access on objects?