A developer needs to expand an application to another AWS Region by copying AMIs and creating a new application stack. Company policy requires that all AMIs be encrypted in every Region, but some current AMIs are unencrypted. How can the developer expand to the destination Region while ensuring AMIs are encrypted?

You cannot directly encrypt an existing unencrypted AMI. To ensure all AMIs are encrypted in the destination Region, you must first create new encrypted AMIs from the unencrypted source AMIs in the original Region. This process involves copying the unencrypted AMI, specifying an encryption key (either AWS managed or customer managed) during the copy operation, which results in a new, encrypted AMI. Once these encrypted AMIs are created, they can then be copied to the destination Region. The original unencrypted AMIs can then be safely removed. Incorrect options: AWS KMS is used for managing encryption keys, not for directly encrypting existing AMIs. AWS Certificate Manager (ACM) is for managing SSL/TLS certificates, not for AMI encryption. Copying unencrypted AMIs to the destination Region first and then attempting to enable encryption by default will not encrypt the already copied unencrypted AMIs. Encryption by default applies to new resources, not existing ones.