You're kind of missing the point. The whole point of data at rest encryption is: if this drive dies and gets thrown into a dumpster, I don't want some random s

You're kind of missing the point. The whole point of data at rest encryption is: if this drive dies and gets thrown into a dumpster, I don't want some random shmuck to pull it out, put it in a server, run a recovery program against it, and get my customer's SSNs. Now, I would hope Amazon shreds drives that are declared dead, but I wouldn't want to risk my business on it. It has almost nothing to do with protection against a targeted attack and everything to do with chain of custody.