9 ms·
Encrypting Amazon RDS Resources
- adwf 12y agoGreat news, I might finally be able to use RDS now. I'm always impressed that the AWS team seem to be on the ball with improvements - whenever I think "I could really do with X feature", they come out with it a few months later. Having said that, the limitations at the bottom are a little arduous if you're already on RDS. Can't encrypt an existing unencrypted database. So you'd think to take a backup and restore to a new encrypted DB, but you can't do that either. Nor can you stream from an unencrypted master to an encrypted replica, freeze and swap over. Bit of a pain there!
- nahname 12y agoEncrypting backups makes a lot of sense. Is encrypting an active db a requirement in some enterprise environments?
- ceejayoz 12y agoPCI compliance requires that, IIRC.
- michaelmior 12y agoBeen a while since I've had to deal with PCI, but I don't think encryption is required.
- Spooky23 12y agoIt is now. From https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pd... PCI Requirement 3.4: Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: - One-way hashes based on strong cryptography, (hash must be of the entire PAN) - Truncation (hashing cannot be used to replace the truncated segment of PAN) - Index tokens and pads (pads must be securely stored) - Strong cryptography with associated key-management processes and procedures. PCI Requirement 3.5 Document and implement procedures to protect keys used to secure stored cardholder data against disclosure and misuse.
- michaelmior 12y agoPerhaps this is new in v3 since I was working under v2 at the time. It certainly makes sense that the card number must be stored encrypted.
- ceejayoz 12y agohttp://www.csoonline.com/article/2124346/compliance/end-to-end-encryption--the-pci-security-holy-grail.html http://www.csoonline.com/article/2124346/compliance/end-to-e... > Section 3 provides the high-level details around encryption. At a minimum, PCI requires the PAN (primary account number) to be rendered unreadable anywhere it is stored, including portable digital media, backup media and logs.
- randerson 12y agoIt is if you store credit card numbers.
- kolev 12y agoYes, it's 2014 and credit card numbers should not be stored and tokenization is the standard.
- vertex-four 12y agoSomebody's got to store the number eventually.
- kolev 12y agoActually, not really.
- kolev 12y agoThis new feature encrypts the entire database. PCI compliance requires only to encrypt the account number, i.e. the credit card number.
- Hovertruck 12y agoHIPAA requires encryption-at-rest of any personally identifiable information.
- chrisfarms 12y agoThis is encrypting the disk that the RDS instance is using to store the data right? And amazon are holding the decryption key. What exactly is this protecting against? (Genuine question not rhetoric). Without encryption, I guess someone with physical access to an Amazon data center could pull a drive somewhere and grab the data. With encryption, that same person would also have to get hold of the key as well, but nothing seems to be said about the key storage being in some separate super secure location, so could that same malicious employee with physical access not also go on a key hunt and end up getting access anyway? So it's just another "layer" of protection not totally impossible. .... or am I missing something crazy obvious where an unencrypted RDS disk is accessible by some other means? Maybe via to nature of disks being reused without proper cleaning or similar?
- dmourati 12y agoOne idea is to audit the use of the encryption key.
- wiredfool 12y agoI'm curious how one could implement dual control of keys on Amazon, or if auditing would have ot be a compensating control for it.
- jeffbarr 12y agoCalls made to KMS are logged in CloudTrail where they can be used for auditing.
- toomuchtodo 12y agoI'm assuming CloudTrail logs can be sent to another AWS account with no delete access from the sending account?
- beering 12y agoIt's to comply with IT policies that require data to be encrypted on disk. Now, businesses that wouldn't use RDS before can now tick that last box off on the IT security audit.
- brechmos 12y agoIt looks great but it appears the smallest encrypted RDS is medium. I would love to see it for the micro or small instances (my level :-) ).