- Newest
- Most votes
- Most comments
When your RDS MySQL instance shows the "Inaccessible-encryption-credentials" status, it indicates that there's an issue with accessing the encryption key used for your database. Even though you've reactivated your account and the KMS key appears to be enabled, there are a few steps you should take to resolve this issue:
-
First, double-check that the AWS KMS key associated with your RDS instance is indeed fully enabled and not scheduled for deletion. Sometimes, a key might appear enabled but still have a pending deletion request.
-
If the instance is in the "inaccessible-encryption-credentials-recoverable" state (which lasts for seven days after losing access to the KMS key), you can try to restart the instance. Use the AWS Management Console or run the AWS CLI command:
aws rds start-db-instance --db-instance-identifier your-instance-name
Replace "your-instance-name" with your actual RDS instance identifier.
-
If restarting doesn't work or if more than seven days have passed, the instance may have entered the terminal "inaccessible-encryption-credentials" state. In this case, you cannot recover the instance directly and will need to restore from a backup.
-
To restore from a backup, you'll need to create a new RDS instance using the most recent snapshot or backup available. This process will create a new instance with the data from your backup.
-
After restoring, make sure to update your application's connection settings to point to the new RDS instance.
-
If you had any read replicas or specific multi-AZ configurations, you'll need to set those up again on the new instance.
Remember, it's crucial to always keep backups of your encrypted RDS instances to protect against potential data loss in situations like this. If you're unable to restore from a backup or encounter any issues during the process, you may need to contact AWS Support for further assistance.
Sources
Resolve the inaccessible encryption state in Amazon RDS | AWS re:Post
Encrypting Amazon RDS resources - Amazon Relational Database Service
Amazon RDS Instances "Inaccessible-encryption-credentials" Status | AWS re:Post
Relevant content
asked 3 months ago
- AWS OFFICIALUpdated 6 months ago
- AWS OFFICIALUpdated 5 years ago
