The Council of State confirmed that the decision of the Flemish Authorities to contract with an EU branch of a US company using AWS cloud services does not breach the GDPR. The Council of State relied, among other things, on guidance issued by the EDPB and Flemish Supervisory Commission, which mention encryption as a possible supplementary measure for data transfers to the US. (BYOK, Bring-Your-Own-Key in context of processing of personal data with AWS in the EU)
Summary, links, etc. at NOYB:
https://gdprhub.eu/index.php?title=Council_of_State_-_251.378
More commentary:
See also Doctolib case: