> Dynamo didn’t support encryption at rest. This requirement made some sense in a world where a rogue employee might yank your database server out of a rack an

> Dynamo didn’t support encryption at rest. This requirement made some sense in a world where a rogue employee might yank your database server out of a rack and walk off with it, but I don't understand why this is still considered relevant in an AWS context. First of all your data is never really "at rest", a huge point of Dynamo is that the data is always available (at least 99.999% of "always" anyway). Second "at rest" where? Literally on a physical disk? Even if there was a single physical disk that held it I'm willing to bet that even if you were in the right AWS data center and had support of a willing AWS employee you couldn't find that disk and even if you could there'd be no way to remove it. I'll guess its literally millions of times more likely for you to fail to deprecate some AWS API key that's sitting in clear text on a laptop you sold as surplus than anybody gets their hands on your at rest Dynamo data.