https://docs.aws.amazon.com/id_id/prescriptive-guidance/latest/aws-startup-security-baseline/wkld-09.html
WKLD.09 Encrypt Amazon RDS databases - AWS Prescriptive Guidance
Enable encryption for Amazon RDS databases to protect data at rest using AWS KMS keys during database creation or by migrating to a new encrypted instance.
amazon rdsencryptdatabasesawsguidance
https://docs.aws.amazon.com/id_id/prescriptive-guidance/latest/aws-startup-security-baseline/wkld-12.html
WKLD.12 Use VPC endpoints to access supported services - AWS Prescriptive Guidance
Use VPC endpoints to enable private connectivity from your VPC to AWS services without requiring internet gateways or NAT devices.
to access