Encryption at rest
How Bahriya encrypts MySQL data at rest: MySQL's own encryption, the volume encryption add-on, who holds the keys, and rotating the master key.
A MySQL instance can encrypt its data at rest in two layers. Both are chosen when you create the instance and cannot be switched on or off afterwards.
MySQL encryption
encryptionenabled (Reis: security.encryption, --encryption) turns on MySQL's own encryption:
- every table, including tables you create later,
- the redo and undo logs,
- the binary logs.
Each server encrypts with its own master key. Opting a table out of encryption needs a privilege your database users do not have, so a CREATE TABLE cannot accidentally leave data unencrypted.
Volume encryption (add-on)
volumeencryptionenabled (Reis: security.volume_encryption, --volume_encryption) is a separately billed add-on. It encrypts every disk of the instance at the storage layer, which also covers what MySQL's own encryption does not: temporary files, logs and anything else written to disk. Use it together with MySQL encryption when you want both layers.
Who holds the keys
Both layers use keys that the platform generates and manages. You do not supply or hold a key, and none of the encryption options accept one.
The keys are kept in your vault as platform-managed encryption keys, so you can see them and they are billed like any other vault item:
| Item | Holds |
|---|---|
<handle>-mysql-keyring | An escrow copy of every server's MySQL encryption keys, updated after each change. |
<handle>-mysql-luks | The volume encryption passphrase (with the add-on). It never changes. |
You cannot edit, rotate, detach or delete them. They are released when the instance is terminated.
The instance's passwords are kept the same way, as platform-managed secrets: <handle>-mysql-root for root and <handle>-mysql-<database> for each database user. See Connecting to MySQL.
Rotating the master key
You can rotate the MySQL encryption master key of every server at any time: from the instance's detail page (Rotate master key), with reis mysql:rotate-key <instance-id>, or through the API.
The rotation runs online. Applications stay connected and data stays readable. The new keys are escrowed to your vault, and the request and its outcome appear in the activity log. One rotation runs at a time, and a rotation is refused while a restore from the instance is in progress.
What encryption at rest does not cover
- Backups. Dumps and binary-log backups are written by reading the data through MySQL, so they are not encrypted by either layer. They are stored in the platform's backup storage.
- Data in transit. Use TLS to encrypt connections.