How to Encrypt a RDS DB Instance

Overview

Amazon RDS offers encryption for DB instances, ensuring that data at rest, including underlying storage, automated backups, read replicas, and snapshots are protected. It employs the industry-standard AES-256 encryption algorithm, which operates transparently with minimal performance impact, requiring no modifications to database client applications. This encryption enhances data security against unauthorized access and helps meet compliance requirements. Additionally, when creating a read replica, it must be encrypted with the same KMS key as the primary instance if they are in the same AWS Region; otherwise, the appropriate regional KMS key should be used.

Walkthrough

1. Sign in to the Amazon RDS Console

   Go to the AWS Management Console and log in with your credentials. Then In the console, locate and select RDS from the list of services. In the upper-right corner of the RDS console, select the AWS Region where you want to create your DB instance.

   

2. Start the Database Creation Process

   In the RDS Console pane, click the Create database button.

   

3. Select Database Creation Method and Choose the Database Engine

   Choose Standard create for more configuration options and Under Engine options*, select* MySQL as the database engine.

   

4. Select the Engine Version and Template

   Scroll down the same page and select the compatible version and select the templates depends your needs.

   

5. Select the Availability and Durability

   Here the option to decide do we need DB Cluster or single node or Multi-AZ DB

   

6. Configure DB Instance Settings

   DB instance identifier*: Enter a unique name for your DB instance.*

   Master username*: Specify a username for the database administrator.*

   Master password*: Create a strong password and confirm it.*

   

7. Configure DB Instance Size

   Choose the DB instance class based on your performance needs (e.g., db.t3.micro for a small instance).

   Set the Storage type and allocate the desired amount of storage.

   

8. Configure Connectivity

   Choose the VPC and Subnet group for your DB instance.

   Set the Public accessibility option to determine if the database should be accessible from the internet.

   Configure the VPC security group to control access to the DB instance.

   

   

9. Additional Configuration

   Select and configure Monitoring options

   Under Database options, you can set the initial database name and other parameters.

   Configure backup, encryption, log exports, maintenance, and deletion protection settings as needed.

   — Here the option to encrypt the database instance and you can only encrypt an Amazon RDS DB instance when you create it, not after the DB instance is created.

   

   

10. Review and Create

    Review all your settings to ensure they are correct.

    Click the Create database button to launch your MySQL DB instance at the end of the page.

    

11. Validate the Database instance

    It will take a few minutes to complete the database creation and launch.

    

12. Validate the Encryption of the DB instance

    Click on the DB identifier

    

    Select the Configuration TAB and look on the Storage panel

    

    Remember :You can't turn off encryption on an encrypted DB instance.

    You can't create an encrypted snapshot of an unencrypted DB instance.

---

We have successfully created an encrypted AWS RDS DB instance. Please remember to delete the resources you created if you did it for learning purposes to avoid unnecessary costs on your account.