We are migrating our system to a cloud environment (AWS), and have been given new client requirements for having our MySQL data-at-rest encrypted.
Currently it is unclear how far this should go. It would be very simple to enable disk encryption, however it is being argued internally that this actually only mitigates against disks being stolen (physically or otherwise) but not against server breaches.
It seems there is only limited options to implement DB layer encryption with MySQL (or more accurately, it's drop in replacements like MariaDB or Percona) and there is some flaws with it currently (such as binlogs and caches are not encrypted). Also, app layer encryption would be a massive overhead as the vast majority of queries search on fields that are considered sensitive, and thus will need to be encrypted.
What is the current accepted approach to encrypting sensitive data on a MySQL database in a cloud environment? Please note this is not referring to RDS.