I went through ActiveStorage docs and did some research but couldn't find anything. Is there a way of configuring it so file encryption/decryption happens automatically upon storage/retrieval?
You can do encryption in two ways,
Server Side Encryption is for data at rest, when you create the bucket you can configure the encryption keys. AWS will take of the rest.
You can also encrypt Client side as well. Decryption needs to happen on the client as well.
It depends how you want to handle it.
More Documentation on how to configure:
https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html
Hope it helps.