How do you handle encryption at rest and in transit across a cloud environment?

Enforce modern TLS on every hop, including internal service to service traffic, and use managed certificates so renewal is automatic. Encrypt every data store at rest with keys from a managed key service, using your own customer managed keys where you need separate access control, auditing or the ability to revoke. Control access through key policies, enable rotation, and log every key use. Encrypt sensitive fields client side when even the platform should not read them.

In transit, modern TLS everywhere, and I mean internal traffic too, not just the edge, because assuming the private network is safe stopped being defensible a long time ago. Managed certificates for anything public so renewal is not a manual task somebody forgets. At rest, every store encrypted, and the important choice is whose key. Platform default keys give you the encryption but almost no separation of duties, so for anything sensitive I use customer managed keys, one per data domain, because then the key policy is a real access control: I can grant a specific role decrypt rights, audit every use of the key, and revoke access to a whole dataset by changing one policy rather than chasing permissions. Rotation is enabled and key usage logs feed the same place as everything else. For the most sensitive fields, things like tokens or personal identifiers, I encrypt client side before they are written, so the storage service only ever sees ciphertext. That costs you queryability, so it is deliberately narrow, applied to specific fields rather than everything.