Encryption at rest clarification for Lightsail database instance

Amazon Lightsail MySQL database instances use encryption at rest managed by AWS. This means the underlying storage volumes are encrypted using AWS-managed keys, which qualifies as full disk encryption. So yes, full disk encryption applies in your case. Container encryption does not apply here, because Lightsail databases are not deployed in containers that support container-level encryption. Database-level encryption such as MySQL's native tablespace encryption is not exposed or configurable in Lightsail. So unless you've implemented something custom within your application layer, this method doesn't apply either.

According to AWS Lightsail documentation, MySQL database instances in Lightsail automatically implement encryption at rest using AWS-managed keys. Specifically:

• Full Disk Encryption: Yes - Lightsail database instances use encryption at rest for the underlying storage volumes by default (except for the smallest database bundle).

• Container Encryption: No - Lightsail databases are not deployed in containers, so container-level encryption is not applicable.

• Database Level Encryption: No - Native database-level encryption features (like MySQL tablespace encryption) are not exposed or configurable in Lightsail managed databases.

The encryption is managed automatically by AWS on your behalf, providing security for your sensitive data at the storage level.

For more information, you can refer to:

1. Lightsail FAQ (https://aws.amazon.com/lightsail/faq/) which confirms encryption at rest for Lightsail services
2. Related rePost discussions:
   • "Managed databases - encrypted?" which discusses PostgreSQL encryption
   • "Encryption of LightSail Instances" which covers general Lightsail encryption topics