AWS RDS for MySQL now supports encrypted storage backends. This encrypts the MySQL data and binlogs with a key within AWS's key management system, thus causing offsite replication issues because we do not have the binlog key on our private replica. We know that you can not replicate encrypted->unencrypted and unencrypted->encrypted, so the question is this:
- Can we provide encryption keys to AWS for the RDS storage encryption such that we can use that key in our remote replication (offsite, not in AWS) to replicate properly?
- If so, what is the procedure for generating a key and uploading it AWS?
(We don't have an AWS support agreement, so if you do, perhaps you could ask on our behalf to answer this question.)
Thanks for your help!