AWS AmazonRDS: Aurora blue/green: encrypt green environment with different KMS key
Summary
Removes the limitation that an unencrypted DB cluster can't be converted to encrypted, and adds a section documenting how to encrypt the green environment with a different AWS KMS key via TargetKmsKeyId in TargetResourceConfigurations.
Security assessment
The added text documents encryption-at-rest configuration for blue/green deployments, including KMS key requirements and permissions, which is security best-practice guidance rather than a fix for a specific vulnerability.
Evidence
+You can create a green environment whose storage is encrypted with a different AWS KMS key than the blue environment. Use this to encrypt an unencrypted DB cluster or one that uses an AWS owned key, or to change the KMS key of an encrypted DB cluster. To do so, specify `TargetKmsKeyId` in [TargetResourceConfigurations](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateBlueGreenDeployment.html) when you create the blue/green deployment. Set the `SourceArn` to the ARN of the source DB cluster. Aurora applies the key at the DB cluster level, so you don't specify it for individual DB instances.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/blue-green-deployments-considerations.md b/AmazonRDS/latest/AuroraUserGuide/blue-green-deployments-considerations.md index cf77f10..498e33f 100644 --- a//AmazonRDS/latest/AuroraUserGuide/blue-green-deployments-considerations.md +++ b//AmazonRDS/latest/AuroraUserGuide/blue-green-deployments-considerations.md @@ -55 +55 @@ The following general limitations apply to blue/green deployments: - * You can't change an unencrypted DB cluster into an encrypted DB cluster. In addition, you can't change an encrypted DB cluster into an unencrypted DB cluster. + * You can't change an encrypted DB cluster into an unencrypted DB cluster. @@ -217,0 +218,8 @@ The following behavior results if you delete a DB instance in the DB cluster in + * **Encrypting the green environment** + +You can create a green environment whose storage is encrypted with a different AWS KMS key than the blue environment. Use this to encrypt an unencrypted DB cluster or one that uses an AWS owned key, or to change the KMS key of an encrypted DB cluster. To do so, specify `TargetKmsKeyId` in [TargetResourceConfigurations](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateBlueGreenDeployment.html) when you create the blue/green deployment. Set the `SourceArn` to the ARN of the source DB cluster. Aurora applies the key at the DB cluster level, so you don't specify it for individual DB instances. + + * The KMS key must exist and be enabled, and you must have permission to use it. + + * `TargetResourceConfigurations` isn't supported for Aurora Global Databases, so you can't change the encryption of the green environment for a Global Database. +