aws rds describe-db-instances

aws rds modify-db-instance --db-instance-identifier <your-db-instance-identifier> --kms-key-id <your-kms-key-id>

aws rds describe-db-instances --db-instance-identifier <your-db-instance-identifier> | grep KmsKeyId

import boto3

# Create an RDS client
rds = boto3.client('rds')

# Get a list of all RDS instances
instances = rds.describe_db_instances()

# Loop through each instance and check if it is using a KMS key for encryption
for instance in instances['DBInstances']:
    if 'KmsKeyId' not in instance:
        # If the instance is not using a KMS key, modify it to use one
        rds.modify_db_instance(
            DBInstanceIdentifier=instance['DBInstanceIdentifier'],
            KmsKeyId='your_kms_key_id_here'
        )

resource "aws_kms_key" "database_tier" {
  description             = "KMS key for database tier encryption"
  deletion_window_in_days = 30
  enable_key_rotation     = true

  tags = {
    Tier = "Database" # Required: identifies this KMS key as the database-tier key
  }

  # OPTIONAL BUT RECOMMENDED: Replace THIS with a least-privilege policy
  # that grants necessary IAM users/roles/services access to use the key.
  # key_policy = jsonencode({
  #   Version = "2012-10-17"
  #   Statement = [
  #     {
  #       Sid       = "EnableRootAccount"
  #       Effect    = "Allow"
  #       Principal = { AWS = "arn:aws:iam::${DATA_ACCOUNT_ID}:root" }
  #       Action    = "kms:*"
  #       Resource  = "*"
  #     }
  #   ]
  # })
}