AWS Cloud Practitioner Questions | RDS, Aurora, & ElastiCache

You cannot directly configure RDS Read Replicas to be encrypted if the source DB instance is unencrypted. However, you can create an encrypted snapshot of the original unencrypted database and then restore from that snapshot to create an encrypted RDS instance or its read replicas.

Here's a step-by-step process:

1. Create a Snapshot: Take a snapshot of your existing unencrypted RDS instance.
2. Encrypt the Snapshot: When copying this snapshot, you can enable encryption for it using AWS KMS (Key Management Service).
3. Restore from Encrypted Snapshot: Restore the encrypted snapshot to create an encrypted version of your original database or its read replicas.

Therefore, while you cannot directly encrypt a Read Replica of an unencrypted RDS instance, you can achieve this by first creating and then restoring from an encrypted snapshot.

So the correct answer is:

No, you must first restore the source DB instance from an encrypted snapshot to create encrypted Read Replicas.

This ensures that all data at rest in your database environment is securely encrypted.

Read the full article at DEV Community

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.