I was going by this update for EKS 
CodePudding user response：
short answer, yes it encrypted at rest
The answer is yes, the data stored by etcd is encrypted at rest.
AWS EKS is a managed Kubernetes offering. Kubernetes control plane components such as API Server, and ETCD are installed, managed, and upgraded by AWS. Hence you can neither see these components nor can exec into these components.
The below article also shows how to get cloud trail events when Kubernetes secrets are decrypted using KMS.