EncryptionConfiguration
class EncryptionConfiguration
How a resource's data at rest is encrypted. kmsKeyArn is required when encryptionStrategy is CUSTOMER_MANAGED and must be absent when it is AWS_OWNED; a mismatch is a ValidationException rather than a silently ignored field, so a caller that selects AWS_OWNED while still passing a key learns that the key was not applied.