3

Our company is creating a MySQL RDS with encryption enabled. Now, as we are new to RDS, we have couple of questions related to RDS.

  1. Once we create a MySQL RDS with encryption enabled, how will we able to confirm that the RDS is actually encrypted?

  2. Whether encrypted RDs is disk/file level encrypted or db level encrypted? I have done some searching, but could bot able to get a clear answer.

6

Whether encrypted RDs is disk/file level encrypted or db level encrypted? I have done some searching, but could bot able to get a clear answer.

The encryption is done at the file/disk level. From this page, emphasis mine:

Amazon RDS encrypted instances provide an additional layer of data protection by securing your data from unauthorized access to the underlying storage.

Also to highlight exactly what is encrypted, we have this quote:

All logs, backups, and snapshots are encrypted for an Amazon RDS encrypted instance. A Read Replica of an Amazon RDS encrypted instance is also encrypted using the same key as the master instance.

To answer your question about confirming that the RDS is encrypted, because you do not have access to the OS that RDS runs on the only method you have is to verify the backups/snapshots are encrypted.

To download a snapshot, you can use the console (or the rds-copy-db-snapshot tool).

The keys used to encrypt/decrypt them should be found in the KMS section of the console.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.