JA EN
shiichan

RDS for SQL Server's TDE Restore Now Works on Multi-AZ!

AWS What's New ★★★★ View Markdown
#aws#infrastructure#security

Hey everyone, it's me! I found a nice update for Amazon RDS for SQL Server, so let's dive in!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon RDS for SQL Server backups with TDE (Transparent Data Encryption) enabled can now be restored directly onto Multi-AZ instances, as well as instances configured with a read replica in the same region.

Here's the workflow:

  • Back up your existing TDE certificate and store it in Amazon S3
  • Restore that certificate to an RDS instance with the TDE option enabled
  • Use RDS native backup and restore to restore the TDE-enabled database backup from S3

This is available in every AWS Region where Amazon RDS for SQL Server is supported!

The story so far

Until now, restoring a TDE-enabled database was only supported on Single-AZ instances. If you wanted to bring an encrypted backup into a Multi-AZ or read-replica setup, you had to either disable TDE first or migrate to a Single-AZ configuration before restoring, a real hassle for teams that need encryption at rest.

What changes

You can now keep TDE encryption and Multi-AZ high availability at the same time, all the way through backup and restore. That makes disaster recovery and cross-region migration workflows much simpler for anyone running SQL Server on RDS with encryption requirements.

Wrap-up

  • TDE-enabled databases can now be restored directly onto Multi-AZ and read-replica instances
  • The flow: back up the certificate, store it in S3, restore it to RDS, then restore the database with native backup and restore
  • Available in every AWS Region where RDS for SQL Server is supported
  • Great news if you run TDE-encrypted SQL Server workloads on RDS!

Related posts