Database Encryption at Rest and in Transit

Encryption is the process of scrambling readable data (called plaintext) into an unreadable format (called ciphertext) using a secret value called a key. Only someone with the correct key can reverse the process (decrypt) to get back the original data. Think of a key as a very long password that a computer uses automatically.

Encryption protects data in two separate states: at rest and in transit. Data at rest means data stored on a physical medium such as a hard drive, a solid-state drive, a backup tape, or a database file on disk. If someone steals the physical drive, or gains access to the storage system, encrypted data is useless to them because they cannot read it without the key. Data in transit means data moving across a network — for example, from your application to the database, or from one database to another during replication. If an attacker intercepts network traffic, encrypted data looks like random noise and cannot be understood.

AWS provides several tools to achieve encryption at rest and in transit. The most important one for the DBS-C01 exam is AWS Key Management Service (KMS). KMS is a managed service that creates, stores, and rotates encryption keys. You never have to manage the underlying hardware or software that protects the keys. KMS integrates with many AWS services, including Amazon RDS (Relational Database Service), Amazon Aurora, Amazon DynamoDB, and Amazon Redshift.

When you enable encryption at rest for an Amazon RDS database, AWS uses a key from KMS to encrypt the database storage, the automated backups, the read replicas, and the snapshots. The encryption happens at the storage layer — the database engine itself does not need to be modified. When your application reads data from the database, AWS automatically decrypts the data in the background using the same KMS key. This process is transparent to your application.

For encryption in transit, the standard approach is to use TLS (Transport Layer Security), formerly known as SSL (Secure Sockets Layer). TLS creates an encrypted tunnel between a client and a server. To use TLS, the server must present a digital certificate. A certificate is like a digital passport that proves the server's identity. AWS Certificate Manager (ACM) lets you provision, manage, and deploy these certificates for use with AWS services such as RDS, Aurora, and Elastic Load Balancing. ACM can automatically renew certificates, so you never have an expired certificate that breaks connectivity.

Database-level encryption features are additional options built into the database engine itself. For example, Amazon RDS for Oracle supports Transparent Data Encryption (TDE). TDE encrypts data as it is written to disk and decrypts it as it is read, without requiring changes to the application. Amazon RDS for SQL Server supports Transparent Data Encryption (TDE) as well. Amazon RDS for MySQL and PostgreSQL do not have built-in TDE, so for those engines you rely on the AWS-managed encryption at rest feature that encrypts the entire storage volume.

Why does this matter for security? Compliance frameworks such as PCI DSS, HIPAA, and GDPR often require encryption at rest and in transit for sensitive data. If you are building a healthcare application that stores patient records, you must enable both types of encryption to pass an audit. The DBS-C01 exam will present scenarios where you must decide which encryption method to use, which key to select, and whether a certificate from ACM or a KMS key is the right choice.

A common beginner mistake is thinking that encryption at rest alone is sufficient. If a database has encryption at rest enabled but does not enforce TLS connections, an attacker on the same network could intercept traffic and read plaintext data as it travels between the application and the database. Conversely, if you enforce TLS but leave the database storage unencrypted, someone who steals the physical disk can read all the data. Both layers are required for complete protection.

Another important concept is key rotation. KMS can automatically rotate your keys once per year by default. You can also create new keys manually and change which key a database uses. Rotation limits the damage if a key is compromised — the older key becomes useless for encrypting new data. The DBS-C01 exam tests whether you know that automatic key rotation must be enabled in KMS, and that it only applies to the key material, not the aliases or metadata.

Finally, understand the difference between server-side encryption and client-side encryption. Server-side encryption is when the AWS service (such as RDS) encrypts data on your behalf using a KMS key. Client-side encryption is when your application encrypts the data before sending it to AWS. For the DBS-C01 exam, server-side encryption with KMS is the most commonly tested approach for databases.

An IT professional working for a financial technology company is tasked with securing a new Amazon RDS for PostgreSQL database that will store customer transaction records. The company must comply with PCI DSS, which requires that all cardholder data be encrypted both at rest and in transit.

First, the IT professional creates a customer-managed key in AWS KMS. They choose to create a symmetric key, which means the same key is used to encrypt and decrypt data. They assign key usage permissions to the IAM role that the application uses to connect to the database. They also enable automatic yearly rotation so that the key material is replaced periodically without manual intervention.

Next, they launch an Amazon RDS for PostgreSQL instance. During the creation wizard, they select the option 'Enable encryption' and choose the KMS key they just created. AWS encrypts the database storage, the automated backups, the manual snapshots, and any read replicas with that same key. The IT professional verifies encryption by checking the RDS console, which shows a green indicator next to 'Encryption' on the database details page.

For encryption in transit, the IT professional obtains a public TLS certificate from AWS Certificate Manager. They configure the RDS instance to require TLS connections by setting the 'rds.force_ssl' parameter to '1' in the DB parameter group. They then modify the application's connection string to use the 'sslrootcert' parameter pointing to the trusted CA (Certificate Authority) bundle. Every connection between the application and the database is now encrypted.

The IT professional also tests the setup by attempting to connect without TLS using a raw PostgreSQL client. The connection is refused because the database requires TLS. This confirms that no application can accidentally send plaintext data over the network.

A few months later, an auditor requests evidence of encryption. The IT professional provides:

The auditor is satisfied. The IT professional's careful implementation of both encryption at rest and in transit means the company passes the audit without findings.

If the IT professional had only enabled encryption at rest but forgotten to enforce TLS, the auditor would have noted a finding. PCI DSS explicitly requires that cardholder data be encrypted when transmitted over public networks. The missing TLS enforcement would have been a compliance failure requiring immediate remediation.