We approached the migration as a living system rather than a one-time copy. First, we established a like-for-like encrypted EFS and linked it to the existing volume using native EFS replication. That created a near-real-time mirror capable of tracking the constant flow of changes.

To build confidence, we introduced a neutral observation point that mounted both file systems. From there, we could watch replication progress, compare directory structures, and verify that the encrypted target was converging on the live state. Once replication stabilized, we shifted traffic in a measured way: placing one application server on the encrypted volume while the other continued on the original, using load-balancer health checks as our safety net. This allowed the team to validate real application behaviour, reads, writes, and downstream workflows, on the encrypted store without risking user experience.

When it was time to finalize, we paused background tasks that might generate a last burst of writes, let replication settle, and performed a brief, targeted delta sync with rsync to capture any stragglers. With both sides aligned, we completed the cutover and returned the fleet to normal rotation, now fully on encrypted storage. Throughout, we maintained a clear rollback path, though it was not needed.