content_image/696179.jpg content_image/696178.jpg content_image/696181.jpg content_image/696180.jpg
• keyring_aws : Communicates with the Amazon Web Services Key Management Service (AWS KMS) as a back end for key generation and uses a local file for key storage. 

• keyring_hashicorp : Communicates with HashiCorp Vault for back end storage. 

<img src='content_image/696179.jpg'>

<img src='content_image/696178.jpg'>

## Warning 

For encryption key management, the component_keyring_file  and component_keyring_encrypted_file  components, and the keyring_file and keyring_encrypted_file  plugins are not intended as a regulatory compliance solution. Security standards such as PCI, FIPS, and others require use of key management systems to secure, manage, and protect encryption keys in key vaults or hardware security modules (HSMs). 

A secure and robust encryption key management solution is critical for security and for compliance with various security standards. When the data-at-rest encryption feature uses a centralized key management solution, the feature is referred to as “MySQL Enterprise Transparent Data Encryption (TDE)” . 

The data-at-rest encryption feature supports the Advanced Encryption Standard (AES) block-based encryption algorithm. It uses Electronic Codebook (ECB) block encryption mode for tablespace key encryption and Cipher Block Chaining (CBC) block encryption mode for data encryption. 

For frequently asked questions about the data-at-rest encryption feature, see Section A.17, “MySQL 8.0 FAQ: InnoDB Data-at-Rest Encryption” . 

## Encryption Prerequisites 

•A keyring component or plugin must be installed and configured at startup. Early loading ensures that the component or plugin is available prior to initialization of the InnoDB  storage engine. For keyring installation and configuration instructions, see Section 6.4.4, “The MySQL Keyring” . The instructions show how to ensure that the chosen component or plugin is active. 

Only one keyring component or plugin should be enabled at a time. Enabling multiple keyring components or plugins is unsupported and results may not be as anticipated. 

<img src='content_image/696181.jpg'>

<img src='content_image/696180.jpg'>

## Important 

Once encrypted tablespaces are created in a MySQL instance, the keyring component or plugin that was loaded when creating the encrypted tablespace must continue to be loaded at startup. Failing to do so results in errors when starting the server and during InnoDB  recovery. 

•When encrypting production data, ensure that you take steps to prevent loss of the master encryption key. If the master encryption key is lost, data stored in encrypted tablespace files is unrecoverable.  If you use the component_keyring_file  or component_keyring_encrypted_file  component, or the keyring_file  or keyring_encrypted_file  plugin, create a backup of the keyring data file immediately after creating the first encrypted tablespace, before master key rotation, and after master key rotation. For each component, its configuration file indicates the data file location. The keyring_file_data  configuration option defines the keyring data file location for the keyring_file plugin. The keyring_encrypted_file_data  configuration option defines the keyring data file location for the keyring_encrypted_file  plugin. If you use the keyring_okv  or keyring_aws plugin, ensure that you have performed the necessary configuration. For instructions, see Section 6.4.4, “The MySQL Keyring” . 

## Defining an Encryption Default for Schemas and General Tablespaces 

