ServicesSolutionsIndustriesExpertiseResourcesCompanyMore…Updated: Sep 4, 2025 Have you ever wanted to encrypt an unencrypted Aurora MySQL Cluster with the mínimum downtime? You can’t create an encrypted replica from an unencrypted Aurora cluster. So I’m going to explain how to encrypt an unencrypted Aurora MySQL database using the binlog replication feature. I will assume that you have a custom DNS record for the database that points to the Aurora cluster endpoint. Well, let’s do it!First, you have to enable BinLogs on the existing Aurora Cluster. Select the cluster parameter group of the Aurora clusterSelect the parameter binlog_formatModify the value to ROWThen, reboot the DB instance to apply the change. In AWS RDS console, go to SnapshotsSelect the System tabSelect the latest snapshot of the Aurora Cluster. For example: rds:my-aurora-cluster-2020-09-15-05-00In Actions, select Restore snapshot, and then configure the instance according to your needs but ensure to enable encryption using the default aws/kms key.Wait until the new cluster is ready In the old DB cluster, create a new DB user specifically for replication and grant permissions:In the new DB cluster, enable replication (the filename and position can be found in the Events list of the new DB instance):Wait until the load is complete and validate that the ongoing replication continues with replication lag = 0Schedule a maintenance window.Set the site in maintenance mode.Stop the servers to prevent transactions from being recorded on the old DB while switching the databaseStop the old DB cluster.Stop BinLog replication in the new DB cluster:mysql> CALL mysql.rds_stop_replication;Change the DNS record of the cluster DB to point to the new DB cluster endpointSet the site in production mode. And that’s it. Now you have a fully functional Aurora MySQL cluster with encryption at rest using KMS. AWS KMS does more than secure your databases. Extend your encryption strategy from Aurora & KMS to container image protection in Security [email protected] & AnalyticsAI & Cloud ComputingSolutionsManaged ServicesIndustriesUtilitiesResourcesSucces StoriesStartupsFinancial ServicesBlogSmall & Medium BusinessFrom Idea to Gen AICloud FitEcommerce & RetailOil and GasCompanyAboutJoin usExpertiseAWS Well ArchitectedAWS LambdaAmazon CloudfrontAmazon AuroraAmazon EKSAWS WAFAmazon ECSAmazon Open SearchCopyright © 2026 Teracloud USA LLC.All Rights Reserved. All trademarks are property of their legal owners.AWS GlueAPI Gateway