Why should you care?

Patient or payment data on disk stolen from datacenter — encryption at rest limits exposure if keys managed properly.

See it live — copy this example

Run in MySQL Workbench or the mysql CLI.

-- Enable table encryption (requires keyring setup on server):
CREATE TABLE accounts_secure (
  account_id INT UNSIGNED PRIMARY KEY,
  balance_inr DECIMAL(14,2) NOT NULL
) ENCRYPTION='Y';

-- Client TLS: require SSL in user account
STATUS LIKE 'Ssl_cipher';

What happened?

• ENCRYPTION=Y stores InnoDB pages encrypted on disk.
• Client STATUS shows Ssl_cipher when connected over TLS — traffic encrypted in flight between app and RDS.

Practice next

1. Connect with --ssl-mode=REQUIRED in mysql CLI.
2. Check STATUS for Ssl_cipher not empty.
3. On RDS: enable encryption at rest at instance create (cannot toggle easily later).
4. Compare connection with ssl-mode=DISABLED (dev only if allowed).
5. Read AWS RDS encrypt replica same as primary requirement.

Remember

TLS for connections; table/KMS for at-rest. Cloud RDS encryption is common default. Key management is the hard part.

DataFlow PCI scope

RDS encrypted + app REQUIRE SSL — audit checkbox for cardholder DB.

Outcome: Compliance pass without custom crypto in app.