How to encrypt a production unencrypted RDS Aurora MySQL 8 cluster

Hi, thanks for the answer!

According from here https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Replication.MySQL.html Aurora does support native binlog replication, although it does not use it apparently for read replicas. Would be possible to promote a read replica to a new cluster and enable MySQL binlog replication between the original cluster and the new one? Then I could redirect traffic to the new one once the replica lag is zero, minimizing the downtime

From the documentation : https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.html

• You can't convert an unencrypted DB cluster to an encrypted one. However, you can restore an unencrypted snapshot to an encrypted Aurora DB cluster. To do this, specify a KMS key when you restore from the unencrypted snapshot.
• You can't create an encrypted Aurora Replica from an unencrypted Aurora DB cluster.

So the process could be something similar to below

• Schedule some down time for the application
• Stop all traffic to the database
• Create a final snapshot from the current unencrypted cluster
• Import that snapshot into a new encrypted cluster
• Bring up your application now pointing to the new cluster

Also note that Aurora does not use bin log replication - the replication is done on the storage layer and not within MySQL.

Alternative process to the one I mentioned above to minimize downtime by creating a new encrypted cluster and replicating data to it before cutting over.

We are mostly following guidance here : https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Replication.MySQL.html

1. Enable binary loggong on unencrypted Aurora cluster (note this requires a reboot as we are changing the cluster parameter group)

2. Enable binary log retention on the unencrypted cluster. You do this by setting a configuration as Aurora does not allow you access to underlying logs

3. Create a snapshot of the unencrypted database. This is a fairly straightforward process with the console or aws cli

4. Create a new encrypted cluster from snapshot Key step here is to make sure you have a KMS key and you use that kms key id when restoring the snapshot (https://docs.aws.amazon.com/cli/latest/reference/rds/restore-db-cluster-from-snapshot.html shows the --kms-key-id parameter to use)

5. Create a replication user on unencrypted cluster

6. enable replication on encrypted cluster

7. continue to replicate till ready to migrate

8. When ready to migrate stop all traffic to unencrypted cluster

9. monitor replication to ensure its complete to the encrypted cluster

10. Stop replication (on both encrypted cluster and unencrypted cluster)

11. do some sanity checks, maybe shutdown unencrypted cluster cleanly

12. Migrate application to new encrypted cluster

Please make sure you accept the answer if it helps!