I have a running RDS Aurora MySQL 8.0.23 cluster running in production. The database is unencrypted and I need to enable encryption for it. As far as I understand, this is not possible to do directly. The procedure I am evaluating is:

  1. Create a read replica on the current cluster.
  2. Stop replication on replica and annotate binlog filename and position.
  3. Promote the read replica to a new encrypted cluster (maybe it requires to do a snapshot before).
  4. Set up back replication with the original cluster using binlog file and position annotated before.
  5. Wait until replication lag is zero.
  6. Redirect production traffic to the new cluster.
  7. Stop replication.
  8. [Optional] Delete old cluster.

I have two issues with the above procedure:

  • Once created the replica, running commands like SHOW SLAVE STATUS or SHOW REPLICA STATUS return empty set, so I can't annotate binlog file and position. Please note that replication is enabled on the original cluster (binlog_format is set to ROW).
  • It seems I can't promote the Aurora read replica to a new cluster, the option is missing on the available actions. But according to the documentation it should be possible.

Has anyone have feedback about the issues above? What is the current up-to-date procedure to encrypt an Aurora MySQL cluster with minimum downtime and no data loss?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.