You are right. I use KMS sometimes, but that’s server side encryption. KMS protects a master key. It doesn’t protect data encryption keys encrypted with that ma

You are right. I use KMS sometimes, but that’s server side encryption. KMS protects a master key. It doesn’t protect data encryption keys encrypted with that master key. Those keys are exposed outside HSMs, in places like S3 in RAM or sometimes disks. Further, the encryption and decryption of data are done outside HSM. So, I know my disk encrypted with KMS is not protected from AWS. But I guess the audits help here. Also, client side encryption works for things like backups. End to end encryption rules out a lot of features. Therefore lot of companies store data in plaintext (data base, web servers, user facing services etc).