Encrypting Master Root Volume

For my application, all storage devices require encryption. I have a config file that specifies the following:

\[cluster default]
...
ebs_settings = custom

\[ebs custom]
encrypted = true

The resulting instance has two drives:
/dev/sda1 (not encrypted)
/dev/sdb (encrypted)

According to this thread: https://forums.aws.amazon.com/thread.jspa?messageID=720702＾, I would need to point to a custom AMI with an encrypted drive. Is this the current solution? Is there a better way to make an encrypted drive from scratch?