AWS AmazonRDS: Added blue/green deployment option for RDS encryption and KMS key change
Summary
Adds a note that a blue/green deployment can create a green environment encrypted with a different KMS key than the blue environment, enabling encryption of an unencrypted DB instance or KMS key rotation.
Security assessment
Documents an operational path to encrypt an unencrypted DB instance or rotate its KMS key, which is encryption guidance with security impact but not tied to a specific vulnerability or incident.
Evidence
You can also use a blue/green deployment to create a green environment that's encrypted with a different KMS key than the blue environment. Use this deployment to encrypt an unencrypted DB instance or to change the KMS key of an encrypted DB instance. For more information about blue/green deployments, see [Limitations and considerations for Amazon RDS blue/green deployments](./blue-green-deployments-considerations.html).
Diff
diff --git a/AmazonRDS/latest/UserGuide/Overview.Encryption.md b/AmazonRDS/latest/UserGuide/Overview.Encryption.md index c9d6a02..458fb94 100644 --- a//AmazonRDS/latest/UserGuide/Overview.Encryption.md +++ b//AmazonRDS/latest/UserGuide/Overview.Encryption.md @@ -53,0 +54,2 @@ If you must change the encryption key for your DB instance, create a manual snap +You can also use a blue/green deployment to create a green environment that's encrypted with a different KMS key than the blue environment. Use this deployment to encrypt an unencrypted DB instance or to change the KMS key of an encrypted DB instance. For more information about blue/green deployments, see [Limitations and considerations for Amazon RDS blue/green deployments](./blue-green-deployments-considerations.html). +