- The user must provide the encryption key
- AWS must manage the encryption key
- No encryption key is required
- The default AWS encryption key must be used