Before I give my answer, lets first go over the subject of HMAC.
Hash-based message authentication code (or HMAC) is a mechanism for calculating a message authentication code involving a hash function in combination with a secret key. This can be used to verify the integrity and authenticity of a a message.
Now HMAC authentication guarantees the authenticity of the request by signing the headers, this is especially the case if content-md5 is signed and checked by the server AND the client. In most situations I have used HMAC to have a more robust level of security.
But be advised, using HMAC opens you up to a larger understanding of how HTTP works, which can either make things harder on you or easier depending on your depth of knowledge.
HMAC alongside AES is a great set to have. In my opinion I would use it.
Also keep in mind that if you tend to keep this encrypted information on a server for long periods of time you should keep the secret key fresh monthly or maybe bi monthly pending on how you structure your security.