I wish AWS official clients did this automaically by default. Customers could opt out from encryption if it is public data. When an aws account is created it also creates a default CMk (specific to that aws account) for entire service which customers could change if they want.