# How to Encrypt a RDS DB Instance

### Overview

Amazon RDS offers encryption for DB instances, ensuring that data at rest, including underlying storage, automated backups, read replicas, and snapshots are protected. It employs the industry-standard AES-256 encryption algorithm, which operates transparently with minimal performance impact, requiring no modifications to database client applications. This encryption enhances data security against unauthorized access and helps meet compliance requirements. Additionally, when creating a read replica, it must be encrypted with the same KMS key as the primary instance if they are in the same AWS Region; otherwise, the appropriate regional KMS key should be used.

### Walkthrough

1. **Sign in to the Amazon RDS Console**
    
    *Go to the AWS Management Console and log in with your credentials. Then In the console, locate and select RDS from the list of services. In the upper-right corner of the RDS console, select the AWS Region where you want to create your DB instance.*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730197470392/834f62a3-47c9-4bf6-ae5a-2fe0855a0146.png align="center")
    
2. **Start the Database Creation Process**
    
    *In the RDS Console pane, click the Create database button*.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730197811043/dc26cc80-ffb7-44a9-9282-c416788dab84.png align="center")
    
3. **Select Database Creation Method and Choose the Database Engine**
    
    *Choose* ***Standard create*** *for more configuration options and Under* ***Engine options***\*, select\* ***MySQL*** *as the database engine.*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730198052771/3bf333c9-97ca-4cdb-bb45-9fcdb10595aa.png align="center")
    
4. **Select the Engine Version and Template**
    
    *Scroll down the same page and select the compatible version and select the templates depends your needs.*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730198521701/cbe9684f-f5b2-4aa4-b51b-16bdeb267322.png align="center")
    
5. **Select the Availability and Durability**
    
    *Here the option to decide do we need DB Cluster or single node or Multi-AZ DB*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730199081042/c6dcf465-5577-4166-804a-47e66f557cfc.png align="center")
    
6. **Configure DB Instance Settings**
    
    ***DB instance identifier****: Enter a unique name for your DB instance.*
    
    ***Master username****: Specify a username for the database administrator.*
    
    ***Master password****: Create a strong password and confirm it.*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730199473415/f070ab5a-560b-48d5-a70c-099cd0599fd3.png align="center")
    
7. **Configure DB Instance Size**
    
    *Choose the* ***DB instance class*** *based on your performance needs (e.g., db.t3.micro for a small instance).*
    
    *Set the* ***Storage type*** *and allocate the desired amount of storage.*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730200966580/7f4746b3-9ba7-4c09-92fa-952b907fbb4d.png align="center")
    
8. **Configure Connectivity**
    
    *Choose the* ***VPC*** *and* ***Subnet group*** *for your DB instance.*
    
    *Set the* ***Public accessibility*** *option to determine if the database should be accessible from the internet.*
    
    *Configure the* ***VPC security group*** *to control access to the DB instance.*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730201265038/9f9fac64-9fd5-483f-9899-9c543c66017f.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730201361264/1ceb477d-da04-4455-8815-87270ecf40fb.png align="center")
    
9. **Additional Configuration**
    
    Select and configure Monitoring options
    
    Under **Database options**, you can set the initial database name and other parameters.
    
    Configure backup, **encryption**, log exports, maintenance, and deletion protection settings as needed.
    
    — ***<mark>Here the option to encrypt the database instance and you can only encrypt an Amazon RDS DB instance when you create it, not after the DB instance is created.</mark>***
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730201794818/1895ba13-2317-4a4f-adc2-cf0db8098357.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730201883772/ec5cb388-eb3e-4bcc-9a1a-54cac1aacd8a.png align="center")
    
10. **Review and Create**
    
    *Review all your settings to ensure they are correct.*
    
    *Click the* ***Create database*** *button to launch your MySQL DB instance at the end of the page.*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730202219059/d5e0e05e-4245-42df-8669-1608a857b01a.png align="center")
    
11. **Validate the Database instance**
    
    *It will take a few minutes to complete the database creation and launch.*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730202576209/d76216ff-8c95-4344-9627-2f2fd09137d2.png align="center")
    
12. Validate the Encryption of the DB instance
    
    Click on the **DB identifier**
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730202770433/a5d68c2b-0b5e-4152-b9bb-1d50fe4bc0d2.png align="center")
    
    *Select the Configuration TAB and look on the Storage panel*
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730203021295/5b645e1c-3ca8-4292-b66f-fa9e955f2b8e.png align="center")
    
    ***<mark>Remember</mark>*** *<mark> :You can't turn off encryption on an encrypted DB instance.</mark>*
    
    *<mark>You can't create an encrypted snapshot of an unencrypted DB instance.</mark>*
    

---

We have successfully created an ***encrypted AWS RDS DB instance***. Please remember to delete the resources you created if you did it for learning purposes to avoid unnecessary costs on your account.