AWS AmazonRDS: RDS blue/green: encrypt green environment with different KMS key
Summary
Removes the limitation that an unencrypted DB instance can't be converted to encrypted, and adds a section documenting how to encrypt the green environment with a different AWS KMS key via TargetKmsKeyId per source DB instance.
Security assessment
Documents encryption-at-rest configuration and KMS key requirements for RDS blue/green deployments, providing security best-practice guidance rather than addressing a specific vulnerability.
Evidence
+You can create a green environment whose storage is encrypted with a different AWS KMS key than the blue environment. Use this to encrypt an unencrypted DB instance or one that uses an AWS owned key, or to change the KMS key of an encrypted DB instance. To do so, specify `TargetKmsKeyId` for each source DB instance in [TargetResourceConfigurations](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateBlueGreenDeployment.html) when you create the blue/green deployment.
Diff
diff --git a/AmazonRDS/latest/UserGuide/blue-green-deployments-considerations.md b/AmazonRDS/latest/UserGuide/blue-green-deployments-considerations.md index 363ed45..5c8fa82 100644 --- a//AmazonRDS/latest/UserGuide/blue-green-deployments-considerations.md +++ b//AmazonRDS/latest/UserGuide/blue-green-deployments-considerations.md @@ -51 +51 @@ The following general limitations apply to blue/green deployments: - * You can't change an unencrypted DB instance into an encrypted DB instance. In addition, you can't change an encrypted DB instance into an unencrypted DB instance. + * You can't change an encrypted DB instance into an unencrypted DB instance. @@ -223,0 +224,8 @@ The same behavior applies to DB instances and read replicas. + * **Encrypting the green environment** + +You can create a green environment whose storage is encrypted with a different AWS KMS key than the blue environment. Use this to encrypt an unencrypted DB instance or one that uses an AWS owned key, or to change the KMS key of an encrypted DB instance. To do so, specify `TargetKmsKeyId` for each source DB instance in [TargetResourceConfigurations](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateBlueGreenDeployment.html) when you create the blue/green deployment. + + * The KMS key must exist and be enabled, and you must have permission to use it. + + * If the blue primary DB instance is unencrypted or uses an AWS owned key, you must also specify a `TargetKmsKeyId` for each of its unencrypted read replicas. Green read replicas are created from the green primary and otherwise inherit its key. +