DBaaS encryption and SSL

Each DBaaS instance has two separate security settings. Disk encryption protects the data stored on disk, and SSL protects the connection to the DBaaS instance.

Disk encryption

Disk encryption encrypts everything the DBaaS instance and its Read Replicas store on disk. It uses LUKS full-disk encryption, with the aes-xts-plain64 cipher and a 512-bit key. Encryption is off by default. To encrypt a DBaaS instance, check Enable Encryption under Advanced Settings when you create it; it stays on for as long as the DBaaS instance exists. In Enter Passphrase(Optional), set your own passphrase of 8 to 12 characters, with an uppercase letter, a lowercase letter, and a special character, or leave it blank to get a generated one; see Create a DBaaS instance.

An encrypted DBaaS instance keeps its Read Replicas in its own region; see Read Replicas.

SSL

SSL encrypts the connection between a client and the DBaaS instance. A new DBaaS instance is created with SSL already on. On an older DBaaS instance from before SSL was the default, or one where SSL was turned off, turn it on with Enable SSL in the More Actions menu. See Enable SSL on a DBaaS instance. With SSL on, every connection uses SSL, and the CA Certificate row under Connection Details has a Download link for the file your client uses to check the server; see Connect to a DBaaS instance.