What is the threat model for deciding between unencrypted vs. encrypted EBS volumes?

Question

Let me start by saying that I'm not questioning the utility of encrypting EBS volumes, nor asking how it works.

I'm just wondering what specifically encrypting EBS volumes is protecting against?

For my personal laptop, the reason to encrypt the hard drive is if it ever gets stolen, while the thief could create a copy of my hard drive, the data is encrypted at rest and can't be decrypted without logging into my laptop and/or providing the decryption key.

For an unencrypted EBS volume attached to an EC2, I would assume that the data can only be accessed by the EC2 that it's attached to. Or at least, the data cannot be accessed by anything/anyone besides that EC2 without specifically allowing access to it. Is this assumption wrong?

If this assumption is correct, then encrypting the EBS volume is protecting against...what? The possibility of the hard drive being stolen from Amazon's datacenter? Or I guess someone could infiltrate their network and digitally copy the data from hard drives, which would then be encrypted?

I'm just curious about the threat model.

Answer 1

Basically, you've answer you're own question. Except one nagging thing... all hard drives fail at some point, and must be disposed of. If someone disposed of the drive improperly, or simply steals the "broken" drive and forges the paperwork then I would certainly want the drive encrypted. Walking out the front door of an Amazon data center is the least likely way for a hard drive to get stolen from there. Or any data center for that matter.

Many companies use third party services to dispose of IT assets, and you have no control over them. Even if they are standing in front of you holding a hammer and are telling you they will smash it with a hammer, once it leaves your sight you have no idea if they actually did. Or if they copied the drive before shredding it.

In cyber security, trust no one. Trust me on that.