Consider providing client-side encryption/decryption methods that do not pass the sensitive data to AWS

[bjorg]

See:

• http://techblog.invitationdigital.com/2015/07/21/aes-and-kms-in-dot-net/
• https://github.com/ica-carealign/AwsContrib.EnvelopeCrypto