Enable encryption on existing database - AWS RDS Postgresql

Question

I have an AWS RDS postgresql database that was provisioned via terraform with encryption disabled: storage_encrypted = false

This database needs to be encrypted now but I can see from the docs that enabling encryption is something that can only be done during DB creation.

I was considering creating a read replica of this instance with encryption enabled and then promoting this replica to be a standalone instance and finally pointing my app to this new instance. Is there a simpler way?

Answer 1

One of the ways to achieve this in a non-production environment is as follows -

1. Stop writes on the instance, ie. stop the applications writing to the RDS tables
   
2. Create a manual snapshot of the unencrypted RDS instance
   
3. Go to Snapshots from the left panel and choose the snapshot just created
   
4. From the Actions, choose Copy snapshot option and enable encryption
   
5. Select the new encrypted snapshot
   
6. Go to Actions and select Restore snapshot
   

For a minimal downtime switch follow this -
https://aws.amazon.com/premiumsupport/knowledge-center/rds-encrypt-instance-mysql-mariadb/