3.1.1 Encryption at Rest
Cloud disks, S3, and database storage use AES keys held in KMS. The app may also encrypt specific columns.
Why it matters
Hardware reuse, backup tapes, and stolen laptops should not dump the user table.
How it is used
Turn on default encryption for every bucket and RDS instance. Restrict KMS key users. Column encryption for SSNs when compliance asks — know the query tradeoffs.