AWS RDS for MySQL now supports encrypted storage backends. This encrypts the MySQL data and binlogs with a key within AWS's key management system, thus causing offsite replication issues because we do not have the binlog key on our private replica. We know that you can not replicate encrypted->unencrypted and unencrypted->encrypted, so the question is this:

  • Can we provide encryption keys to AWS for the RDS storage encryption such that we can use that key in our remote replication (offsite, not in AWS) to replicate properly?
  • If so, what is the procedure for generating a key and uploading it AWS?

(We don't have an AWS support agreement, so if you do, perhaps you could ask on our behalf to answer this question.)

Thanks for your help!

  • "thus causing offsite replication issues" -- can you clarify what issues those are? Storage encryption does not mean that the binlog stream is encrypted, so I'm not sure what's wrong with logical replication. Or are you talking about storage replication? – mustaccio May 10 at 20:03
  • @mustaccio, RDS binlogs are encrypted. I said "thus causing problems" as in the key exists remotely but doesn't on my private non-RDS replica so it can't apply the binlog. See this link: dev.mysql.com/doc/refman/8.0/en/… – KJ7LNW May 10 at 20:06
  • Binlogs are encrypted at rest; the question stands: how exactly do you replicate? – mustaccio May 11 at 1:42
  • Would this process work for you? – matigo May 11 at 5:17
  • @matigo, that is what we usually do, but it doesn't work for encrypted volumes because we either need to provide AWS with a key to use (share), or we need to download the key from AWS. Since AWS doesn't allow the latter, we would need to provide a key---but in what format and how do you link it in? – KJ7LNW May 11 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.