How to Encrypt an Unencrypted RDS DB Instance
Tags: rds, database, snapshot
Published: 2023-03-18 02:06:23

# Encrypting RDS DB Instance

- Amazon RDS can encrypt your Amazon RDS DB Instances.

- When the encrypt option is enabled for the AWS RDS Resources, we are able to encrypt DB Instances, Automated Backups, Read replicas, Snapshots and Logs.

- Amazon RDS encrypted DB instances use the AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances.

- The Encrypt option can be enabled only when you are launching the DB instance, it cannot be enabled after launch. However, copies of unencrypted snapshots can be encrypted.

- Amazon RDS encrypted DB instances provide an additional layer of data protection by securing your data from unauthorized access to the underlying storage. 

- You can use Amazon RDS encryption to increase data protection of your applications deployed in the cloud, and to fulfill compliance requirements for encryption at rest.   

Please visit my **[GitHub Repository for RDS articles](https://github.com/awsmine/RDS_projects)** on various topics being updated on constant basis.


_**Let’s get started!**_


# Objectives:

**1.** Signin to AWS Management Console

**2.** Create RDS MySQL instance (***`uncheck -  enabling encrypt option`***)

**3.** Create a snapshot

**4.** Make a copy of the snapshot and encrypt it

**5.** Restore DB Instance from the encrypted snapshot

**6.** Change the name of the original DB Instance

**7.** Change the name of the Restored DB Instance to the original DB Instance name

**8.** Delete the original RDS Instance and snapshot

**9.** Delete AWS Resources

# Pre-requisites:
- AWS user account with admin access, not a root account.

# Resources Used:

- [What is Amazon Relational Database Service (Amazon RDS)?](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html)

- [Encrypting Amazon RDS resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html)

- [Backing up and restoring a DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BackupRestore_Instance.html)


# Steps for implementation to this project: 

- Please read my article for the below 4 steps 

- [How you create a MySQL RDS Database Instance and RDS Database Snapshot](https://dev.to/aws-builders/create-rds-database-snapshots-4nba).

## 1. Signin to AWS Management Console
## 2. Create RDS MySQL instance (***`uncheck -  IMPORTANT: Enable encryption option.`***).
## 3. Create a snapshot
## 4. Validate the creation of RDS snapshot 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bx7d9ki53gmta1ykld7o.png)


- Click on the database ***`myrdsinstance`***, go to the Configuration tab to check that the Encryption is not enabled


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8hnaklpfsi6djs0b40mp.png)


- Validate the snapshot creation


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tqm30n2dm97eajnxr35d.png)


## 4. Make a copy of the snapshot and encrypt it.

- Under the Manual snapshots, select the ***`myrdsinstancesnap`***, click on Actions, Copy snapshot 

- Under Settings, region - ***`US East (N.Virginia)`***, New DB Snapshot Identifier - ***`myrdsinstancesnap-encrypted`***

- Under Encryption, check Enable Encryption, AWS KMS key - (default) aws/rds

- Copy snapshot

- Wait for 5-6 minutes to see the snapshot encrypted.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1l7abqscuvp7qh80kt14.png)


## 5. Restore DB Instance from the encrypted snapshot.

- Click on the encrypted snapshot - ***`myrdsinstancesnap-encrypted`***, Actions, Restore snapshot, Under Availability and durability, Deployment options, Check Single DB instance, Under Settings, Enter name of DB Instance - ***`myrdsinstancerestore-encrypted`***, Burstable classes (including t classes) - ***`db.t3.micro`***

- ***`Under Encryption, you can see the Enable Encryption is enabled and cannot make changes since the snapshot is encrypted`***, Take all defaults like the original db instance ***`myrdsinstance`***

- Restore DB Instance

- Wait for 5-6 minutes to see the Restore DB Instance 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/acciugh3r18wyytiysrp.png)

  
## 6. Change the name of the original DB Instance.

- Make sure that the Endpoint of the restored DB Instance should be the same as the original DB Instance.

- To do so, we have to change the names of the DB Instances as the names are unique.

- Select the original DB Instance ***`myrdsinstance`***, Modify

- Change the DB Instance Identifier to ***`myrdsinstance-unencrypted`***, Take all defaults

- Continue

- Under Schedule modifications, select Apply Immediately

- Modify DB instance

- Verify the new values of the DB Instance Identifier and the Endpoint


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vv43dm55qk7aagdr1xov.png)

- Wait for 5-6 minutes to see the change


## 7. Change the name of the Restored DB Instance to the original DB Instance name.

- Select on the restored database ***`myrdsinstancerestore-encrypted`*** and click on Modify

- Change the DB Instance Identifier to ***`myrdsinstance`***

- Take all defaults, Continue.

- Under Scheduling of modifications, select Apply Immediately 

- Modify DB instance

- Verify the new values of the DB Instance Identifier ***`myrdsinstance`*** and the Endpoint


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i0ecuikieekyqihub9vh.png)

- Wait for 5-6 minutes to see the change

- Open ***`myrdsinstance`*** i.e, the encrypted DB Instance

- Click on the database and go to the Configuration tab

- Notice that the Encryption is enabled


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fv0liu4rg2h5qy17aggq.png)


## 8. Delete the original RDS Instance and snapshot.

- ***Click on Databases present to the left of the screen***

- Select the Unencrypted DB Instance (i.e ***`myrdsinstance-unencrypted`***, Actions, Delete option.

- Uncheck the Create final snapshot option

- Check the Acknowledge box

- Confirm the deletion by entering ***`delete me`***

- delete

- ***Snapshots on the left of your screen***

- Under Manual snapshots, select the unencrypted snapshot (i.e ***`myrdsinstancesnap`***, Actions, Delete snapshot 

- Delete

- Under Manual snapshots, select the encrypted snapshot (i.e ***`myrdsinstancesnap-encrypted`***, Actions, Delete snapshot 

- Delete

- Wait for 5-10 minutes to see that they are deleted


## 9. Delete AWS Resources

- Delete the encrypted ***`myrdsinstance`***


# What we have done so far

- We have successfully Encrypted an Unencrypted RDS DB Instance.