I'm just wondering what specifically encrypting EBS volumes is protecting against?
For my personal laptop, the reason to encrypt the hard drive is if it ever gets stolen, while the thief could create a copy of my hard drive, the data is encrypted at rest and can't be decrypted without logging into my laptop and/or providing the decryption key.
For an unencrypted EBS volume attached to an EC2, I would assume that the data can only be accessed by the EC2 that it's attached to. Or at least, the data cannot be accessed by anything/anyone besides that EC2 without specifically allowing access to it. Is this assumption wrong?
If this assumption is correct, then encrypting the EBS volume is protecting against...what? The possibility of the hard drive being stolen from Amazon's datacenter? Or I guess someone could infiltrate their network and digitally copy the data from hard drives, which would then be encrypted?
I'm just curious about the threat model.