FWIW, KMS can get expensive if you're (for example) using transparent S3 encryption. Once you enable that (which is actually of dubious security value anyway), every S3 operation involves a KMS operation, which can get surprisingly substantial pretty fast. (I'm not making any comment on Sops per se - just saying to be careful around KMS,and thus Sops, for high-volume requirements.)
FYI the value isn't necessarily in stopping AWS from maliciously reading your data if they wanted to (though it does make that slightly more difficult too), it's knowing that your data can't be easily recovered by someone who has access to the physical hard drives it's stored on. A typical scenario would be someone who knows where old drives are disposed of once they leave the data center - presumably AWS takes measures to wipe/destroy such drives, but knowing that the underlying data is encrypted at rest is extra assurance. There's also value for people whose compliance requirements dictate data is encrypted at rest regardless of cost and whether it actually makes sense to do.