With a publicly accessible cluster, AWS recommends admins always use security groups or network access control lists (network ACLs) to restrict access; Database encryption is enabled by default .