RDS offers encryption at rest, but this is incompatible with cross-region replication. The documentation states:
Because KMS encryption keys are specific to the region that they are created in, you cannot copy an encrypted snapshot from one region to another or replicate encrypted DB instances across regions.
However, it is now possible to upload a custom KMS master key. If I generate my own master key and upload it to both eu-west-1 and eu-central-1, is it possible to is it possible to replicate an encrypted RDS instance across regions?
The documentation does not say anything about this scenario. It's possible that it's now technically possible but the API does not permit it.