Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Would love it if someone could help me out with this:

The setup is a distributed LAMP architecture hosted on Amazon EC2 instances. MySQL Percona. We use Amazon's EBS snapshots for backups. We have a security requirement for encryption of sensitive data. \

1) Is it possible to encrypt EBS snapshots and not the EBS filesystem from which the snapshots are taken? If so, how? 2) If not, what are the industry standards for encrypting MySQL databases in EC2 + EBS and what are the performance trade-offs for these different methods?

share|improve this question
    
if your requirements state that the data must be encrypted, how is it encrypted in the production state? Is it encrypted through the built-in MySQL features or through a standard disk level encryption? –  Patrick Aug 13 '12 at 17:11
add comment

2 Answers

Answers:

[1] No, and here's why -- http://aws.amazon.com/ec2/faqs/#Do_you_offer_encryption_on_Amazon_EBS_volumes_or_snapshots

[2] For encrypting databases, you will also have to encrypt the connection which if you use RDS is supported -- http://aws.amazon.com/rds/faqs/#53 and if you use your own MySQL on an instance, you can set it up to accept SSL connections.

For encrypting mysql database itself, see -- http://thinkdiff.net/mysql/encrypt-mysql-data-using-aes-techniques/ which uses AES 128 which is FIPS approved. This may help as well -- http://planet.mysql.com/?tag_search=6679

share|improve this answer
    
that's more proof than a why. Being pedantic. –  Sirex Aug 13 '12 at 22:24
add comment

You haven't provided enough details about your security requirements for a complete answer, but one straightforward way to make sure that your MySQL snapshots are encrypted is to save the MySQL database on top of an encrypted block device on top of an EBS volume.

You can do this with cryptsetup/LUKS which supports industry standard encryption.

The layers would look like this:

3 - Database files

2 - File system (XFS or ext4)

1 - Encrypted block device (cryptsetup)

0 - EBS volume (/dev/xvdX or /dev/sdX)

Everything sent to EBS would then be encrypted including the snapshots.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.