RDS DB instances should have encryption at-rest enabled

How to fix it

• Replaces the resource: Encryption cannot be turned on in place: snapshot the instance, copy the snapshot with encryption, restore the copy, repoint clients, rebuild read replicas, then delete the original.
• Interrupts service: The new instance holds only what the snapshot captured, so stop writes before taking it or plan to replay them.

In the console

RDS → Snapshots → Copy snapshot with Encryption enabled, then Restore snapshot into a new DB instance

Enable Encryption

Selected, on the copy (the restore has no encryption setting)

AWS KMS key

Your choice of key, settled first: an instance's key cannot be changed later

With Terraform

• Can't be undone: In Terraform storage_encrypted is create-only, so applying it to this instance replaces it with an empty one.

resource "aws_db_instance" "this" {
  instance_class    = var.instance_class
  storage_encrypted = true
  kms_key_id        = var.kms_key_arn
}