We have a PostgreSQL database hosted on AWS RDS. When it was created using cloudformation I set it to be encrypted, but didn't set the encryption key. As such it was set up to use the default encryption key.

I've since been told that there is a company standard that all RDS instances should have their own keys.

I've created the new key using cloudformation and associated it with the RDS instance, but when I deploy this template it wants to delete and recreate the database.

I'm not that familiar with how all this works and I'm after a procedure that doesn't result in us losing data. A bit of downtime won't hurt us if that is required.


With RDS this is easy. You will have some downtime that depends on the amount of data. For a small instance an hour, for a large instance set aside a day. The good part is that after your create the snapshot you can test independently without affecting your instance.

Everything is performed in the AWS RDS Console.

1) Create a snapshot of your RDS instance.

2) Copy the snapshot selecting a new master key.

3) Restore the instance or create a new instance from the snapshot.

Note: For items like this that modify data, I prefer to just create a new RDS instance. Verify everything and then shutdown the old instance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.