Amazon EBS Encryption
The Todo List application backend services will run on a fleet of EC2 instances distributed across multiple Availability Zones within the N. Virginia region. This will ensure that all data held on storage services will continue to reside within the US borders to fulfill the data residency requirements of the business. While the data created and managed by end customers of the Todo List application will reside in the Amazon RDS database deployed in the last chapter, it is just as imperative to consider encrypting the EBS volumes attached to the instances hosting the backend application.
Amazon EBS uses AWS KMS for all encryption services, enabling you to encrypt the root and data volumes using AES-256 data encryption. When you encrypt an EBS volume, all data that resides on the volume and any data that moves between the volume and the instance is encrypted. Encryption operations are performed on the servers that host the EC2 instances.
You can attach both...