Enabling encryption on an RDS DB instance is a simple task. There are just a couple of additional switches that need to be passed on to the New-RDSDBInstance cmdlet. But, before you enable encryption on the DB instance, you need to have a key created in KMS. For key creation, you need to write a policy document in JSON format first.
I have created a sample policy document, as follows, which indicates that the role WorldPressAppRole can administer the key in my account. I saved the JSON document as D:\data\Policies\KMSPolicy.txt on my desktop.
{ "Id": "key-consolepolicy-3", "Version": "2012-10-17", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::<account_no> ...
