Amazon EKS now envelope encrypts all Kubernetes API data by default 

Amazon EKS now mandates default envelope encryption for Kubernetes API data in clusters running on Kubernetes version 1.28 or later. Supporting this new measure, AWS Key Management Service (KMS) enables users to deploy either AWS-managed keys or their own. This update seamlessly integrates enhanced security features without incurring extra costs across all AWS Regions. Embrace security, but keep the budget in check!