- Encrypted using client-side encryption
- Encrypted using server-side encryption with Amazon S3-managed keys (SSE-S3)
- Always encrypted with your KMS key
- Encryption is optional