Or enabling full-drive encryption without a password ... as long as you are using the default AWS-managed keys. I don't make any real adjustments to my risk mo

Or enabling full-drive encryption without a password ... as long as you are using the default AWS-managed keys. I don't make any real adjustments to my risk models until I enable customer-managed keys. At this point, the encryption is really facilitating a secondary access control mechanism audit mechanism. That said, these additional mechanisms can be quite effective when you know how to use them.