A company is deploying a compute-heavy application on a fleet of Amazon EC2 instances. The application stores data on attached Amazon EBS volumes created at deployment time. The application processes sensitive data, and all stored data must be encrypted without affecting application performance. Which solution satisfies these requirements?

Configuring EC2 instances to use encrypted EBS volumes is the most straightforward and performant solution. EBS encryption is transparent to the application and EC2 instance, meaning it encrypts data at rest and in transit between the instance and the volume without requiring application-level changes or impacting performance. Modifying the application to write to an encrypted S3 bucket would require significant application refactoring and would likely introduce latency due to network transfers, impacting performance. Implementing a custom encryption algorithm within the application is complex, error-prone, and would consume CPU resources, negatively affecting performance. Building an AMI with an encrypted root volume only encrypts the operating system; ephemeral instance storage is not persistent and would result in data loss if the instance stops or terminates, making it unsuitable for application data storage.