Amazon RDS Encryption
Amazon RDS offers encryption of data at rest, which comprises the underlying storage, automated backups, snapshots, logs, and read replicas. Like Amazon EBS, Amazon RDS uses industry-standard AES-256-bit encryption using AWS KMS keys for all encryption operations.
Some important concepts to be aware of include the following:
- Read replicas must use the same KMS keys if they are placed in the same region as the primary DB instance.
- If the read replica is in a different region from the primary, then you must use the KMS keys of the target region where the read replica exists.
- You can encrypt Oracle and SQL Server DB instances with Transparent Data Encryption (TDE).
- You can use a different KMS key when copying an encrypted snapshot from the one used to encrypt the original snapshot.
In addition, there are certain limitations for encrypting Amazon RDS data, some of which are listed as follows:
- You can only encrypt a DB instance...