There is a danger too to encrypting your data with non built in KMS key: The key can be deleted and your data can become irrecoverable. KMS has a waiting period of 7-30 days when it is deleted but it is up to you to alert yourself of the fact that someone deleted it. We have AWS config alerts on this that send out via various means.