I found this article that shows how to do the encryption part. https://medium.com/@mattgillard/how-to-enforce-encryption-on-aws-rds-the-correct-way-4c55251ce40e

{
  "Version": "2012-10-17",
  "Statement": [
{
      "Action": [
        "rds:CreateDBInstance"
      ],
      "Condition": {
        "StringNotLike": {
          "rds:DatabaseEngine": "aurora*"
        },
        "Bool": {
          "rds:StorageEncrypted": "false"
        }
      },
      "Effect": "Deny",
      "Resource": [
        "*"
      ],
      "Sid": "DenyUnencyptedRDS"
    },
    {
      "Sid": "DenyUnencyptedAurora",
      "Effect": "Deny",
      "Action": [
        "rds:CreateDBCluster"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "Bool": {
          "rds:StorageEncrypted": "false"
        }
      }
    }
  ]
}