I was about to say you don't get encryption at rest with a low-end instance, but that looks like it's no longer the case since this summer.