AES-256
on every object, at rest
Encrypted before it lands.
Objects are encrypted on the way to disk and decrypted on the way back out, below your code. There are no keys to manage, no setting to find, and nothing to change in how you read and write.