What is RDS Encryption ?
We can encrypt Amazon RDS DB instances and snapshots with enabling encryption option for our any amazon RDS instance . It means data is encrypted at rest including underling storage of DB instances , its read replicas , snapshots and automated backups
Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. You don't need to modify your database client applications to use encryption.
For encrypted and unencrypted DB instances, data that is in transit between the source and the read replicas is encrypted, even when replicating across AWS Regions
Possibilities to encrypt RDS Instance :
Using snapshot copy option we have to enable encryption for RDS snapshot , and restore the snapshot with new instance
- Take snapshot of current production instance
- Copy snapshot with enabled encryption
- Restore the snapshot with different instance identifier
- Rename the current production instance identifier to proddb-old
Once renamed production instance , rename instance identifier of encrypted RDS to current production name
Steps to Encrypt RDS instance :
Step 1 : Take a snapshot of unencrypted RDS instance with any specified name
Step 2 : Make a copy of snapshot with encryption enabled option
Here , we can add default master key else if any consumer keys available use the same
Note : Encrypted read replicas must be encrypted with the same key as the source DB instance when both are in the same AWS Region
Step 3 : We are ready with encryption enabled snapshot copy
Step 4 : Restore rdssnapshotwithencryption
We have launch the instance identifier with rdssnapshotwithencryption
Step 5 : Except Naming convention and other network parameters should be same as unencrypted RDS instance
DB Instance identifier : encrypted-instance
Virtual private cloud (VPC) : Same like unencrypted instance
VPC security group : Same like unencrypted instance
DB instance class : Same like unencrypted instance
Step 6 : Once instance has been launched , verify the configuration of encryption
Step 7 : Instance identifier change
Change instance identifier name to _old for unencrypted instance , and change encrypted instance name to production name
Step 8 : verify the application connectivity with encrypted instance
If anything goes wrong , we just need to rename the instance Identifier name in max 2 minutes without major downtime
References :
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html