What kind of "encryption-at-rest" compliance industry or standard are you dealing with? I'm curious to where what AWS supplies suffices. As the encryption and

What kind of "encryption-at-rest" compliance industry or standard are you dealing with? I'm curious to where what AWS supplies suffices. As the encryption and decryption is, AFAICT, automatic and transparent, aren't you merely protecting your data from someone at AWS running off with it? I.e. if your system that does the API calls is somehow exploited, the attacker has your AWS keys and so can get to the encrypted data. Or if there's a programming error in your data access routines that check whether user X can access data Y. Perhaps I'm reading too much into what "encrypted data at rest" really is supposed to provide though (i.e. just data encrypted, key stored on a different system)