CODEWITHSUNDEEP
python-2.7amazon-web-servicesencryptionrdsboto3
anoop-khandelwal
anoop-khandelwal

Reputation: 3860

How to encrypt my existing RDS Instance using Boto3?

I want to encrypt my existing rds instance.I am using the Boto Script to modify db instance.

modified_rds_attributes = rds_conn_boto3.modify_db_instance(
    DBInstanceIdentifier=id,
    StorageEncrypted=True
)

Is it possible to encrypt existing RDS DB Instance? If Yes,then how can I acheive the task?

Upvotes: 4

Views: 1359

Answers (2)

Abdennour TOUMI
Abdennour TOUMI

Reputation: 93353

I agree that "A non encrypted instance cannot be converted to an encrypted one." However , I disagree that there is one way to do the mission.

Another way is to :

  1. take a snapshot from the unencrypted instance.

  2. copy the snapshot by specifying a Key Management System (KMS) encryption key

  3. then restore a new encrypted instance from snapshot

__

Reference https://aws.amazon.com/blogs/aws/amazon-rds-update-share-encrypted-snapshots-encrypt-existing-instances/

Upvotes: 5

Frederick Cheung
Frederick Cheung

Reputation: 84132

A non encrypted instance cannot be converted to an encrypted one. You also cannot create an encrypted instance for a non encrypted snapshot or create an encrypted replica of a non encrypted instance.

The only way is to dump the old instance to a file and then load that into the new (encrypted) instance

Upvotes: 4

Related Questions