FinServe Analytics runs a production Amazon RDS for PostgreSQL instance in us-east-1 that was created unencrypted. Compliance now requires encryption at rest using a customer managed KMS key. They want to minimize downtime during migration. What should they do?

The correct approach is to take a snapshot of the unencrypted database, copy that snapshot while specifying encryption with a customer-managed KMS key, and then restore a new RDS instance from this encrypted snapshot. This creates an encrypted replica of your database. You can then perform a DNS cutover to the new encrypted instance during a maintenance window, minimizing downtime. Modifying the existing DB instance to enable encryption in place is not possible for unencrypted RDS instances; encryption must be set at creation. Enabling EBS encryption by default only affects newly created EBS volumes and will not encrypt existing RDS storage. Sharing a CMK and attempting to enable encryption on an existing unencrypted instance is not a supported operation for RDS.