A security audit discovers that one of your RDS MySQL instances is not encrypted. The instance has a Read Replica in the same AWS region which is also not encrypted. You need to fix this issue as soon as possible. What is the proper way to add encryption to the instance and its replica?

Answer options:

A.Create a DB snapshot from the instance. Copy the DB snapshot with encryption enabled. Restore a new DB instance from the new encrypted snapshot and configure a Read Replica in the new DB instance.
B.Encrypt the DB instance. Launch a new Read Replica and the replica is encrypted automatically.
C.Create a DB snapshot from the RDS instance and encrypt the newly-created snapshot. Launch a new instance and its Read Replica from the snapshot.
D.Promote the Read Replica to be a standalone instance and encrypt it. Add a new Read Replica to the standalone instance.

Correct Answer – A
Existing unencrypted RDS instances and their snapshots cannot be encrypted. Users can only enable encryption for an RDS DB instance when they create it. The limitations can be found in the AWS documentation https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html.
Option A is CORRECT: Because you can encrypt a copy of an unencrypted DB snapshot. Then the new RDS instance launched from the snapshot and the Read Replica of the new DB instance are encrypted.
Option B is incorrect: Because you cannot encrypt an unencrypted RDS instance directly.
Option C is incorrect: Because you cannot encrypt an unencrypted DB snapshot directly according to the above reference. You should create a copy of an unencrypted DB snapshot and then encrypt the new snapshot.
Option D is incorrect: Because an unencrypted DB Read Replica cannot be encrypted. The correct method is to launch a new instance from an encrypted DB snapshot.