title: What attack vectors does AWS SSE-S3 protect you against?
body: <p>Reading into the various SSE options on S3, I'm can't understand the following:</p>
  
  <p>What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against?</p>
  
  <p>I can only think of a physical attack vector, where someone physically gets the HDDs used for S3 storage. In that case, why is this encryption optional? Shouldn't it be a mandatory default, handled by AWS entirely for their own purposes?</p>
  
  <p>In other words, what are the attack vectors that this particular solution helps to mitigate?</p>
  
  <p>Thank you!</p>