Enabling encryption on RDS

Enabling encryption on an RDS DB instance is a simple task. There are just a couple of additional switches that need to be passed on to the New-RDSDBInstance cmdlet. But, before you enable encryption on the DB instance, you need to have a key created in KMS. For key creation, you need to write a policy document in JSON format first.

I have created a sample policy document, as follows, which indicates that the role WorldPressAppRole can administer the key in my account. I saved the JSON document as D:\data\Policies\KMSPolicy.txt on my desktop.

{
  "Id": "key-consolepolicy-3",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws...