AWS AmazonRDS: Aurora encryption inheritance clarified; blue/green re-encryption added
Summary
Clarifies that the default SSE with AWS-owned key applies only to a newly created cluster, and that clones, snapshot copies, and Aurora replicas inherit the encryption state of an unencrypted source. Also narrows the prior claim that logical replication always yields encrypted instances, and adds guidance on using blue/green deployments to encrypt an unencrypted cluster or rotate the KMS key.
Security assessment
The change documents at-rest encryption behavior and the inheritance of encryption state by clones, snapshots and replicas, plus how to encrypt an unencrypted cluster or change its KMS key via blue/green deployment. This is encryption best-practice guidance, not a fix for a specific vulnerability or incident.
Evidence
Amazon Aurora uses an AWS Key Management Service key to encrypt these resources. AWS KMS combines secure, highly available hardware and software to provide a key management system scaled for the cloud. When creating a new database cluster, Amazon Aurora uses Server-Side Encryption (SSE) with an [AWS-owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key) by default. This default applies only to the new cluster itself. Clones, snapshot copies, and Amazon Aurora replicas (read instances) created from an unencrypted source are not automatically encrypted. They inherit the encryption state of their source. However, you can choose from three encryption types based on your security and compliance needs:
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.md b/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.md index 2b36d82..b841af4 100644 --- a//AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.md +++ b//AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.md @@ -40 +40 @@ Amazon Aurora encrypted DB clusters provide an additional layer of data protecti -Amazon Aurora uses an AWS Key Management Service key to encrypt these resources. AWS KMS combines secure, highly available hardware and software to provide a key management system scaled for the cloud. When creating a new database cluster, Amazon Aurora uses Server-Side Encryption (SSE) with an [AWS-owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key) by default. However, you can choose from three encryption types based on your security and compliance needs: +Amazon Aurora uses an AWS Key Management Service key to encrypt these resources. AWS KMS combines secure, highly available hardware and software to provide a key management system scaled for the cloud. When creating a new database cluster, Amazon Aurora uses Server-Side Encryption (SSE) with an [AWS-owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key) by default. This default applies only to the new cluster itself. Clones, snapshot copies, and Amazon Aurora replicas (read instances) created from an unencrypted source are not automatically encrypted. They inherit the encryption state of their source. However, you can choose from three encryption types based on your security and compliance needs: @@ -55 +55 @@ AWS managed keys are a legacy encryption option that remains available for backw -**Important:** For source database instances or clusters created before February 18, 2026 , where you did not opt in for encryption, snapshots, clones, and Amazon Aurora replicas (read instance) created from those sources will remain unencrypted. However, restore operations and logical replication outside the Amazon Aurora cluster will produce encrypted instances. +**Important:** For source database instances or clusters created before February 18, 2026 , where you did not opt in for encryption, snapshots, clones, and Amazon Aurora replicas (read instance) created from those sources will remain unencrypted. However, restore operations outside the Amazon Aurora cluster will produce encrypted instances. @@ -101,0 +102,2 @@ Once you have created an encrypted DB cluster, you can't change the KMS key used +You can also use a blue/green deployment to create a green environment that's encrypted with a different KMS key than the blue environment. Use this deployment to encrypt an unencrypted DB cluster or to change the KMS key of an encrypted DB cluster. For more information about blue/green deployments, see [Limitations and considerations for Amazon Aurora blue/green deployments](./blue-green-deployments-considerations.html). +