When backing up to S3, KMS has a ton of advantages.
Though in that vein, maybe the native S3 encryption at at rest with KMS is sufficient?