Brandom Sherman pointed out to me that some EC2's do encrypt by default: https://aws.amazon.com/ec2/faqs/#nvme-instance-storage