Stealing physical hard drives is really the only thing being protected against here, as far as I can tell. It seems that any instance in your account can acces

Stealing physical hard drives is really the only thing being protected against here, as far as I can tell. It seems that any instance in your account can access any encrypted volume in your account - there's no access control. I imagine Amazon is working on that, but right now if someone were to e.g. get permission to spin up an instance with stolen API keys, then they'd have access to all your encrypted volumes. Someone correct me if I'm wrong. I've actually rolled my own device encryption in the OS layer using LUKS and puppet. The puppet master is heavily locked down, and holds the decryption keys, which are only available to the correct client and then only ever stored in memory. So this provides somewhat more defense in depth than the AWS native solution.