A company is migrating an on-premises application and MySQL database to AWS. The data is highly sensitive and continuously updated. Data must not traverse the internet, and must be encrypted both in transit and at rest. The database is 5 TB. The target schema exists in an Amazon RDS for MySQL instance. The company has a 1 Gbps AWS Direct Connect with both public and private virtual interfaces configured. Design a migration with minimal downtime that satisfies the security constraints. Which solution meets these requirements?

The correct solution uses AWS DMS with full load plus change data capture (CDC) for minimal downtime and continuous updates. Placing the DMS replication instance in a private subnet and using VPC endpoints ensures data does not traverse the internet. AWS KMS for encryption at rest and TLS for in-transit encryption meet security requirements. Incorrect options: Snowball Edge is for large-scale offline data transfer, not continuous updates or minimal downtime. DataSync is for file transfers, not database migration with CDC, and would involve downtime for a 5TB database. S3 File Gateway is for file storage and access, not database migration with CDC, and would also involve significant downtime for a 5TB database backup and restore.