PowerExchange for Amazon Redshift User Guide

10.4.1
- 10.5.4
- 10.5.3
- 10.5.2
- 10.5
- 10.4.0

Back Next

Data Encryption in Amazon Redshift Sources

To protect data, you can encrypt the data when you read the data from a source.

Select the type of the encryption in the

Encryption Type

field in data object read operation properties. The Unload command creates staging files on Amazon S3 for server-side encryption with the AWS-managed encryption keys and AWS Key Management Service key.

Use the customer master key ID generated by AWS Key Management Service in the Unload command for server-side encryption.

You can select the following types of encryption:

None: The data is not encrypted.
SSE-S3: If you select the
SSE-S3
encryption type, the Unload command creates the staging files in the Amazon S3 bucket and Amazon S3 encrypts the file using AWS-managed encryption keys for server-side encryption.
SSE-KMS: If you select
Server Side Encryption With KMS
as the encryption type, the Unload command creates the staging files in the Amazon S3 bucket and Amazon S3 encrypts the file using AWS KMS-managed customer master key or Amazon Resource Name (ARN) for server-side encryption.; The AWS KMS-managed customer master key that you specify in the connection property must belong to the same region where Amazon S3 is hosted.
For example, if Amazon S3 is hosted in the
US West (Oregon)
region, you must use the AWS KMS-managed customer master key enabled in the same region when you select the
SSE-KMS
encryption type.
CSE-SMK: If you select the
CSE-SMK
encryption type, Amazon Redshift uploads the data to the Amazon S3 server by using the master symmetric key and then loads the data by using the copy command with the encrypted option and a private encryption key for additional security.; You must provide a master symmetric key ID in the connection property to enable
CSE-SMK
encryption type.

PowerExchange for Amazon Redshift does not support the server-side encryption with the master symmetric key and client-side encryption with the customer master key.

The following table lists the encryption type support for various environments:

Encryption Type	Native Environment	Blaze Environment	Spark Environment	Databricks Environment
Server-side Encryption	Yes	Yes	Yes	Yes
Client-side Encryption	Yes	No	No	No

Rename Saved Search

Table of Contents

PowerExchange for Amazon Redshift User Guide

PowerExchange for Amazon Redshift User Guide

Data Encryption in Amazon Redshift Sources

Data Encryption in Amazon Redshift Sources