-
Book Overview & Buying
-
Table Of Contents
Amazon Redshift Cookbook
By :
Amazon Redshift by default provides the option to encrypt the cluster at rest using the AES algorithm with a 256-bit key. Key management can be performed by AWS KMS or your hardware security module. When an Amazon Redshift data warehouse is encrypted at rest, it provides block-level encryption. When the data warehouse is encrypted the metadata, snapshots, and recovery points are also encrypted. This enables you to meet your security requirements to comply with PCI, SOX, HIPAA, or GDPR, depending on your needs. Amazon Redshift serverless clusters on creation require encryption using a default or customer-managed key.
Amazon Redshift uses envelope encryption using a robust four-tier hierarchy of encryption keys: master key, cluster encryption key, database encryption key, and data encryption key.

Figure 6.5 – Amazon Redshift encryption
To complete this recipe, you will need the following setup: