A company needs to replicate EBS volume backups to another AWS Region. Most source EBS volumes are encrypted, but some are not; the company requires that all copied backups be encrypted. Which option provides the required encryption while minimizing operational overhead?

Amazon Data Lifecycle Manager (DLM) is the most efficient solution because it automates the creation, retention, and deletion of EBS snapshots. DLM policies can be configured to automatically copy snapshots to another AWS Region and, crucially, encrypt them during the copy process using a specified AWS Key Management Service (KMS) key, even if the source snapshot was unencrypted. This meets both the replication and encryption requirements with minimal operational overhead. Manual snapshots are inefficient and prone to human error. Exporting snapshots to S3 and then using S3 replication adds unnecessary complexity and steps, as EBS snapshots can be copied directly. A custom Lambda function would require significant development, testing, and maintenance, increasing operational overhead compared to the native DLM solution.