Options for changing AWS KMS encryption key for Amazon RDS databases

This article outlines five methods for changing AWS KMS encryption keys on Amazon RDS and Aurora databases, comparing effort, downtime, and engine support for each approach.

• Snapshot and restore: Low effort, minutes-to-hours downtime, supports all RDS engines
• AWS DMS: Medium effort, seconds-to-minutes downtime, supports all RDS engines
• Native database replication: Medium-to-high effort, seconds-to-minutes downtime, MySQL/MariaDB/PostgreSQL only
• Aurora cluster clones: Medium-to-high effort, minutes downtime, Aurora MySQL/PostgreSQL only
• Aurora read replicas: Low-to-medium effort, seconds-to-minutes downtime, Aurora MySQL/PostgreSQL only
• Two KMS key types: AWS managed (default aws/rds) and customer managed keys
• Monitor with CloudWatch and CloudTrail; implement AWS Config rules for compliance
• Retain original instance until confident in migration success; consider data retention policies

Choose the method based on downtime tolerance, database size, technical expertise, and engine capabilities. Test thoroughly in non-production environments before production implementation.