CDK: How to create an encrypted Aurora MySQL-compatible cluster using an un-encrypted snapshot

Question

Using AWS Console, the [process](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.html#Overview.Encryption.Limitations) to create an encrypted Aurora MySQL-compatible cluster using an un-encrypted snapshot is fairly simple.

> You can't convert an unencrypted DB cluster to an encrypted one. However, you can restore an unencrypted snapshot to an encrypted Aurora DB cluster. To do this, specify a KMS key when you restore from the unencrypted snapshot.

However, when using CDK, there is no parameter to provide an encryption key for the class [rds.DatabaseClusterFromSnapshot](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-rds.DatabaseClusterFromSnapshot.html)

What is the CDK based solution for this scenario?

Answer

This is currently not supported, but I verified that this feature is currently being looked into [here](https://github.com/aws/aws-cdk/issues/17241).

CDK: How to create an encrypted Aurora MySQL-compatible cluster using an un-encrypted snapshot

Relevanter Inhalt