A developer wants to expand an application to run in multiple AWS Regions. The developer wants to copy Amazon Machine Images (AMIs) with the latest…

You cannot directly encrypt an existing unencrypted Amazon Machine Image (AMI). To meet the security requirement, a new, encrypted AMI must be created. The correct procedure is to use the CopyImage operation to create a new AMI from the unencrypted source. During this copy process, encryption parameters can be specified, resulting in a new, encrypted AMI in the destination region. This can be done in a single cross-region copy action. Deleting the original unencrypted AMIs is a necessary subsequent step to fully comply with the policy of having only encrypted AMIs.

B: AWS Key Management Service (AWS KMS) provides the encryption keys, but it cannot be used to modify an existing unencrypted AMI. A new, encrypted copy must be created. C: AWS Certificate Manager (ACM) is unrelated to AMI or EBS encryption; it is used for managing SSL/TLS certificates for services like Application Load Balancers and Amazon CloudFront. D: The order of operations is incorrect. Enabling encryption by default after copying the AMI would not encrypt the already-copied resource. The setting must be active before the copy begins.

1. AWS EC2 User Guide for Linux Instances, "Copy an AMI": In the section "Cross-Region copy and encryption," the documentation states, "You can copy an AMI with an unencrypted root device volume to the same or a different Region and encrypt the root device volume of the new AMI in the process." This directly supports the method described in option A.

2. AWS EC2 User Guide for Linux Instances, "Amazon EBS encryption": In the section "Encryption by default," the documentation explains, "If you enable encryption by default, Amazon EBS and snapshot encryption is enabled for your account on a per-Region basis... When you copy an unencrypted AMI and encryption by default is enabled, the new AMI is encrypted." This explains the mechanism that option D attempts to use but gets the order wrong. It also reinforces that a new encrypted resource is created.

3. AWS CLI Command Reference, ec2 copy-image: The documentation for the copy-image command includes the --encrypted parameter, which "specifies whether to encrypt the new AMI." This confirms that encryption is specified during the creation of the new copy.