Setting an encryption key for a replication instance
AWS DMS encrypts the storage used by a replication instance and the endpoint
connection information. To encrypt the storage used by a replication instance,
AWS DMS uses a AWS KMS key that is unique to your AWS account. You can view and manage
this KMS key with AWS Key Management Service (AWS KMS). You can use the default KMS key in your
account (aws/dms) or a KMS key that you create. If you have an
existing AWS KMS encryption key, you can also use that key for encryption.
You can specify your own encryption key by supplying a KMS key identifier to encrypt your AWS DMS resources. When you specify your own encryption key, the user account used to perform the database migration must have access to that key. For more information on creating your own encryption keys and giving users access to an encryption key, see the AWS KMS Developer Guide.
If you don't specify a KMS key identifier, then AWS DMS uses your default encryption key. KMS creates the default encryption key for AWS DMS for your AWS account. Your AWS account has a different default encryption key for each AWS Region.
To manage the keys used for encrypting your AWS DMS resources, you use AWS KMS. You can find AWS KMS in the AWS Management Console by searching for KMS on the navigation pane.
AWS KMS combines secure, highly available hardware and software to provide a key management system scaled for the cloud. Using AWS KMS, you can create encryption keys and define the policies that control how these keys can be used. AWS KMS supports AWS CloudTrail, so you can audit key usage to verify that keys are being used appropriately. Your AWS KMS keys can be used in combination with AWS DMS and other supported AWS services. Supported AWS services include Amazon RDS, Amazon S3, Amazon Elastic Block Store (Amazon EBS), and Amazon Redshift.
When you have created your AWS DMS resources with a specific encryption key, you can't change the encryption key for those resources. Make sure to determine your encryption key requirements before you create your AWS DMS resources.
