“If your EC2 instances are in a private subnet without access to the public network via a public EIP address or NAT gateway, you can still configure the System Manager service through a VPC ...

AWS provides various methods for encrypting AWS RDS resources which includes encrypting data-at-rest in the underlying DB instances, automated backups, read replicas, and snapshots.