Encryption at Rest and in Transit
Protecting stored data from disclosure if the medium is obtained, and network data from disclosure if the path is observed — two different controls against two different threats.
In transit is TLS, and it is the one that defends against the realistic attacker: anyone on the network path. Terminate deliberately and consider mTLS between services.
At rest defends against a narrower threat than people assume. Provider-managed disk encryption protects against someone obtaining the physical medium; it does nothing against a compromised application or a stolen credential, because the storage layer decrypts transparently for any authorised caller. It is close to free and satisfies a common compliance requirement, so enable it — but do not let it be counted as protection it does not provide.
Where a stronger claim is needed, the control is application-level or field-level encryption, where the data is encrypted before it reaches the store and the store never holds the key. That protects against database compromise, and it costs you the ability to index, search or sort on the encrypted field — which is a design constraint, not a configuration setting.
Key management is the substance of both: rotation, separation of duty between key custodian and data custodian, and an audited trail of key use.