How do I change the encryption key that my Amazon RDS DB instances and DB snapshots use?

Resolution

You can't change the encryption key that your Amazon RDS DB instance uses. However, you can create a copy of the RDS DB instance, and then choose a new encryption key for that copy.

Note: When you create a snapshot, data in unlogged tables might not restore.

To create a copy of an RDS DB instance with a new encryption key, complete the following steps:

1. Open the Amazon Aurora and RDS console.
2. In the navigation pane, choose Databases.
3. Select your DB instance.
4. Create a manual snapshot for your DB instance.
5. In the navigation pane, choose Snapshots.
6. Select the manual snapshot.
7. Choose Actions, and then choose Copy Snapshot.
8. Under Encryption, choose Enable Encryption.
9. For AWS KMS Key, choose the new encryption key.
10. Choose Copy snapshot.
11. Restore the copied snapshot.

The new RDS DB instance uses your new encryption key.

Confirm that your data is in your new database and that your application uses the new database. Then, delete the original RDS DB instance.

Related information

Encrypting Amazon RDS resources

Backing up, restoring, and exporting data