Encryption at rest protects you from someone who steals the hard drive. It does nothing against someone holding a working key: to that key, the data is not encrypted at all. Which is how one leaked key in a public file emptied a charity CRM. Read the filing #secrets #aws #charities #infosec
