The biggest benefit is compliance. Many customers have to satisfy external regulators or internal compliance teams who mandate encryption at-rest. Those require

The biggest benefit is compliance. Many customers have to satisfy external regulators or internal compliance teams who mandate encryption at-rest. Those requirements are typically designed for relatively low-security on-premises data-centers and basic systems, rather than the kind of secure facilities and erasure coding schemes that AWS maintains, but always-on encryption makes the checkbox easy. Another often overlooked benefit of at-rest encryption is that it can enable crypto-shredding; delete the object key and the object can no longer be recovered. That's faster, more efficient, and better for the environment compared to other kinds of "secure erasure". Of course if you want robust crypto-shredding you do have to take some care about where the keys might be cached and for how long, but you can't do it without encryption at-rest.