EBS encryption is generally a no-brainer. When you create the volume you have the option to enable encryption. It will encrypt your data at rest, it will encrypt any snapshots taken of the volume, and all data sent between your EC2 instance and the volume is encrypted using KMS AES-256. If you have a volume that is not encrypted you can create a snapshot of your unencrypted volume and then create a new volume from that snapshot, this will allow you to enable encryption, then you simply attach that volume to your EC2 instance.