tl;dr author finds it a hassle to set up proper encryption at rest and rationalizes away why they shouldn’t need to do it.

> You used the AWS default key to encrypt a database?

Don’t do that? Create a separate account to hold keys. Lock it down like you would your domain DNS or anything else with security implications that will impact your entire company.

Share granular read permissions across accounts as needed to encrypt / decrypt.

Agreed it’s time consuming to initially setup, but it’s a solved problem and can be implemented with your IaC flavor of choice (CloudFormation directly, CDK, Terraform, …).