AWS AmazonRDS: Read replicas can use a different KMS key than source
Summary
The encryption overview now states that an encrypted read replica can be encrypted with the same KMS key as the source DB instance or a different KMS key (specified via KmsKeyId / --kms-key-id), including cross-Region replicas where a key in the destination Region must be used.
Security assessment
Documents KMS key selection for encrypted read replicas, including cross-Region key requirements; this is encryption configuration guidance rather than a fix for a specific vulnerability, so it is security-relevant documentation but not an incident response.
Evidence
+ * You can encrypt a read replica of an Amazon RDS encrypted DB instance with the same KMS key as the source DB instance or with a different KMS key. The read replica can be in the same AWS Region as the source or in a different one. To use a different KMS key, specify it with the `KmsKeyId` parameter of the [CreateDBInstanceReadReplica](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstanceReadReplica.html) API operation, or the `--kms-key-id` option of the [create-db-instance-read-replica](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance-read-replica.html) AWS CLI command. If you don't specify a KMS key, the read replica uses the same KMS key as the source DB instance.
Diff
diff --git a/AmazonRDS/latest/UserGuide/Overview.Encryption.md b/AmazonRDS/latest/UserGuide/Overview.Encryption.md index 458fb94..1c96cb3 100644 --- a//AmazonRDS/latest/UserGuide/Overview.Encryption.md +++ b//AmazonRDS/latest/UserGuide/Overview.Encryption.md @@ -58 +58 @@ You can also use a blue/green deployment to create a green environment that's en - * A read replica of an Amazon RDS encrypted instance must be encrypted using the same KMS key as the primary DB instance when both are in the same AWS Region. + * You can encrypt a read replica of an Amazon RDS encrypted DB instance with the same KMS key as the source DB instance or with a different KMS key. The read replica can be in the same AWS Region as the source or in a different one. To use a different KMS key, specify it with the `KmsKeyId` parameter of the [CreateDBInstanceReadReplica](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstanceReadReplica.html) API operation, or the `--kms-key-id` option of the [create-db-instance-read-replica](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance-read-replica.html) AWS CLI command. If you don't specify a KMS key, the read replica uses the same KMS key as the source DB instance. @@ -60 +60 @@ You can also use a blue/green deployment to create a green environment that's en - * If the primary DB instance and read replica are in different AWS Regions, you encrypt the read replica using the KMS key for that AWS Region. + * KMS keys are specific to the AWS Region where they're created. For a read replica in a different AWS Region, specify a KMS key in the destination Region.