A county tax system will store sensitive assessment data in Amazon RDS. Leadership requires encryption at rest and notes that RDS encryption cannot be turned on later for an already unencrypted instance. When should the architect enable encryption?
Select an answer to reveal the explanation.
Short Explanation
RDS encryption is a birth-certificate setting, not a sticker you slap on later. Turn it on when you create the instance (with a KMS key), then restore-from-snapshot tricks are the painful path if you forget. S3 defaults do not encrypt RDS for you.
Full Explanation
Amazon RDS encryption at rest must be enabled when the DB instance is created; you cannot enable encryption on an existing unencrypted instance in place. The architect should select encryption and a KMS key at launch. Encrypting only replicas, relying on S3 defaults, or expecting a live toggle are incorrect approaches for primary data protection.