A new Aurora cluster will store municipal health records. Security requires encryption at rest from day one. What should the team do when provisioning?
Select an answer to reveal the explanation.
Short Explanation
Aurora encryption at rest is a create-time decision—flip it on when you build the health-records cluster. Turning it on later means snapshots, restores, and cutovers, not a casual toggle. Transit TLS does not replace disk encryption.
Full Explanation
Amazon Aurora encryption at rest must be selected when the cluster (or source snapshot) is created; you cannot simply enable it later on an existing unencrypted cluster without a migration path such as snapshot/restore to an encrypted cluster. TLS in transit does not satisfy at-rest requirements for health records. Encrypting only replicas while leaving the writer unencrypted is incorrect.