Why use a separate key for each file? I'm trying to understand "Option 2: Using a Client-Side Master Key" from https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html#client-side-encryption-client-side-master-key-intro.

Basically, it seems that the one-use encryption key is generated, and used to encrypt the file, and then the key is encrypted by the master key and attached as metadata.

What is the benefit of using a separate key for each file when having the master key is the only thing needed for decryption either way, be it in one step or two?
The source quoted says:


  The client-side master key you provide can be either a symmetric key or a public/private key pair.


In the later case, the main benefit of using a separate symmetric key is that only the public key (rather than secret information known beforehand) is needed to encrypt a file. That symmetric key is then forgotten, hence the need to make a separate one for new files. Also, the symmetric encryption (made possible by the extra key) is much faster and less size-expanding than the asymmetric one. This is hybrid encryption at its best.

There are other benefits, that still apply when the master key is symmetric:


Assuming all the encrypted files are public, using a separate key for each file gives the option to release the key allowing decryption of a single particular file, rather than the master key which would reveal all files.
Using a separate key for each file reduces the amount of data enciphered using the same symmetric key; this works towards staying below a safe limit per key after which the encryption used might become weaker (e.g. for 3DES in CTR mode, we can distinguish sizably better than random if 16GByte enciphered with the same key was originally all-zero or compressed video, including when split across multiple files with unique IV and no keystream reuse).
As pointed by Ilmari Karonen in comment, it might sometimes be desirable to change the master key, e.g. if it's derived from a user-supplied password that the user wants to change, without fully decrypting and re-encrypting all the files. Using separate file keys is one way to enable this.