A. Download the SSH RSA public key for Amazon DocumentDB. Update the application configuration to use the instance endpoint instead of the cluster endpoint and run queries over SSH.
B. Download the SSL .pem public key for Amazon DocumentDAdd the key to the application package and make sure the application is using the key while connecting to the cluster.
C. Create a snapshot of the unencrypted cluster. Restore the unencrypted snapshot as a new cluster with the –storage-encrypted parameter set to true. Update the application to point to the new cluster.
D. Create an Amazon DocumentDB VPC endpoint to prevent the traffic from going to the Amazon DocumentDB public endpoint. Set a VPC endpoint policy to allow only the application instance’s security group to connect.
E. Activate encryption at rest using the modify-db-cluster command with the –storage-encrypted parameter set to true. Set the security group of the cluster to allow only the application instance’s security group to connect.