Hacker News Reader

Comment by troublebucket | Hacker News Reader

Has anyone encrypted the storage on a previously unencrypted RDS using Blue/Green?

We did the exact thing not too long ago, but we couldn't do it using blue/green. We were able to minimize downtime quite a bit, but it was on the order of minutes, not seconds. I wrote a little bit about the process here. I spent a lot of time prepping and running the migration, so happy to share any details if it's helpful.

https://phizzle.space/dbadmin/aws/postgres/2023/12/30/rds-en...

Nice article! Did you run into challenges using a DNS record for cut-over from the old DB to the new, encrypted DB?

We recently did this on my team over Christmas this year. We opted not to use Blue/Green for this but instead spun up an encrypted snapshot and began replication from the old database to the new database using MySQL’s tools. Once traffic on our platform was sufficiently low, we cut connections to the database, waited for for replica lag to reach 0 and relaunch the servers with the new databases host info. Our downtime was around a minute.

This is how we're planning to encrypt our RDS Postgres DBs, but with PG's built-in logical replication.

I tried it with DMS and it was so cumbersome. We would've needed to make a lot of schema changes to get DMS to function. Specifically DMS can't replicate a number of character column-types because they were considered CLOB.

Good question. This was a pain point for my small team (me, myself, and I) a little while back. We had an unencrypted db deployed with CDK, and then tried to get it encrypted without losing data.

Were you able to successfully complete the encryption and cut-over?

Yes, we just ended up having to hardcode the db endpoint in the cdk stack after a manually restoration from snapshot into an encrypted db.

Reply on news.ycombinator.com