With Dataflow Runner you define all of the job-steps directly. As such you configure this directly by supplying the appropriate commands to the job_step. For example with S3-Dist-CP you would add the following option:
--s3ServerSideEncryption
If you let us know what job steps you have configured in Dataflow Runner we can likely point out if any other steps need a special addition to use encrypted S3 buckets.
command-runner
this step runs “snowplow-snowflake-transformer”. it takes the enriched events from one bucket, transform then stage the events in another bucket