https://ones.com/blog/aws-data-encryption-rest-transit-guide/