transitEncryptionMode

A setting that enables clients to migrate to in-transit encryption with no downtime. Valid values are preferred and required. When enabling encryption on an existing replication group, this must first be set to preferred before setting it to required in a subsequent apply. See the TransitEncryptionMode field in the CreateReplicationGroup API documentation for additional details.