How to Enable Encryption at Rest on an Existing RDS Instance
A company has an Amazon RDS for MySQL DB instance that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key. The DB instance was originally launched without encryption. Which combination of steps will meet the requirement with the least downtime?
Quick Answer
The correct answer is to take a snapshot of the DB instance, copy the snapshot with encryption enabled using the desired KMS key, and restore the encrypted snapshot to a new DB instance. This is the only viable method because encryption at rest cannot be enabled on an existing, unencrypted RDS instance through a direct modification or by altering a read replica; the underlying storage must be re-provisioned with encryption, which requires the snapshot-copy-restore workflow. On the AWS Certified Database Specialty DBS-C01 exam, this question tests your understanding that RDS encryption is a one-way, instance-level attribute set at launch, and the snapshot copy is the standard path to enable encryption on an existing instance with minimal downtime—though some downtime is unavoidable. A common trap is assuming you can modify the instance or use a read replica to enable encryption, but neither is supported. Memory tip: “Snap, Copy, Restore” — you cannot encrypt a running car, only build a new one from a blueprint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Take a snapshot of the DB instance, copy the snapshot with encryption enabled using the desired KMS key, and restore the encrypted snapshot to a new DB instance.
To enable encryption on an existing unencrypted RDS MySQL DB instance, you must take a snapshot of the instance, copy the snapshot with encryption enabled using the desired KMS key, and then restore the encrypted snapshot to a new DB instance. This process results in some downtime but is the standard method. Option A is incorrect because you cannot create an encrypted read replica from an unencrypted source instance; encryption on a read replica requires the source to be encrypted. Option B is incorrect because you cannot enable encryption on an existing unencrypted DB instance by modifying it; encryption can only be enabled at creation time or by restoring an encrypted snapshot. Option D is incorrect because you cannot restore an encrypted snapshot to the same DB instance ID; you must restore to a new instance, then update the application endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a read replica of the DB instance with encryption enabled, and then promote the read replica to become the primary instance.
Why it's wrong here
Read replicas cannot have encryption enabled if the source is unencrypted.
- ✗
Modify the DB instance and enable encryption using the AWS Management Console.
Why it's wrong here
RDS does not allow enabling encryption on an existing unencrypted instance via modification.
- ✓
Take a snapshot of the DB instance, copy the snapshot with encryption enabled using the desired KMS key, and restore the encrypted snapshot to a new DB instance.
Why this is correct
This is the standard procedure to enable encryption on an existing unencrypted RDS instance.
- ✗
Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to the same DB instance ID.
Why it's wrong here
Restoring to the same instance ID is not possible; you must create a new instance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an Amazon RDS for MySQL database that contains sensitive data. The security team requires that all data be encrypted at rest using a customer-managed key stored in AWS KMS. Which action should be taken to meet this requirement?
easy- A.Enable encryption on the existing RDS instance by modifying the instance.
- ✓ B.Create a new RDS instance with encryption enabled using the KMS key, migrate data, and delete the old instance.
- C.Configure the DB parameter group to require encryption at rest.
- D.Create a snapshot of the unencrypted database and restore it as an encrypted database.
Why B: Amazon RDS encryption at rest with a customer-managed KMS key can only be enabled when the DB instance is created. You cannot enable encryption on an existing unencrypted instance (option A is incorrect). Once you create a new encrypted instance using the desired KMS key, you can migrate the data from the old instance and then delete it. Option D is incorrect because restoring a snapshot of an unencrypted database without modifying encryption settings will result in an unencrypted instance; you would need to create an encrypted copy of the snapshot first, which is not described. Option C is incorrect because DB parameter groups do not control encryption at rest.
Variation 2. A company is storing sensitive customer data in an Amazon RDS for MySQL DB instance. They need to ensure that data is encrypted at rest. What is the simplest way to achieve this?
easy- A.Enable encryption on the existing DB instance by modifying the DB instance settings.
- B.Enable Transparent Data Encryption (TDE) on the MySQL instance.
- ✓ C.Launch a new encrypted DB instance and migrate the data.
- D.Use client-side encryption with AWS KMS to encrypt data before inserting into the database.
Why C: Amazon RDS for MySQL does not allow enabling encryption at rest on an existing unencrypted DB instance. The simplest way to achieve encryption at rest is to launch a new encrypted DB instance and migrate the data. Option A is incorrect because encryption cannot be enabled on an existing DB instance via modification; it requires creating a new instance. Option B is incorrect because RDS for MySQL does not support Transparent Data Encryption (TDE). Option D is incorrect because client-side encryption with AWS KMS is more complex and not the simplest approach.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.