A company runs its database on an Amazon RDS for PostgreSQL DB instance and requires that all client connections to the DB be encrypted. What should a SysOps administrator do to enforce encryption for connections?

To enforce encrypted connections for an Amazon RDS for PostgreSQL DB instance, you must configure the database itself to require SSL. This is achieved by creating and applying a custom DB parameter group that sets the rds.forcessl parameter to 1. This parameter ensures that the PostgreSQL server will only accept connections that use SSL/TLS. Permitting SSL connections via a security group rule only opens the port; it doesn't enforce encryption. Encrypting DB storage with AWS KMS protects data at rest, not data in transit during client connections. Applying a custom PostgreSQL extension is generally not the standard or most efficient way to enforce SSL for RDS; RDS parameter groups provide this functionality natively.