How does an encrypted DynamoDB (the same question applies to RDS as well) query work?

I am trying to understand whether the primary key is encrypted when I choose to [encrypt at rest for AWS DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/encryption.howitworks.html) - 1. If the primary key is encrypted, how does a primary-key lookup get performed under the hood? - 2. If the primary key is not encrypted, then I know how DynamoDB is implemented under the hood, but it seems that it's not entirely safe for some use cases. Any comment on this? Furthermore, if I choose to have a Global Secondary Index for my DynamoDB table, are the primary key of the Global Secondary Index table encrypted? - 1. If not encrypted, I kinda understand how it works under the hood, but certainly some of my data get revealed in plain text; - 2. If encrypted, I'd appreciate understanding how it works.