Which kind of KMS key protects a resource's data at rest.
Data is encrypted with a service owned key. No customer configuration or KMS permissions are required. This is the behavior when no encryption is specified.
Data is encrypted with a customer managed KMS key that you supply.