PowerExchange for Amazon Redshift User Guide for PowerCenter

10.5.6
- 10.5.9
- 10.5.8
- 10.5.7
- 10.5.4.1
- 10.5.4
- 10.5.2

Back Next

Client-side Encryption

Client-side encryption is a technique to encrypt data before transmitting the data to the Amazon Redshift server.

To enable client-side encryption, you must provide a master symmetric key, which is a 256-bit AES encryption key in Base64 format in the connection properties. The PowerCenter Integration Service encrypts the data by using the master symmetric key or customer master key.

The PowerCenter Integration Service encrypts the files that are uploaded to Amazon S3 at the client-side. If you enable both server-side and client-side encryption for an Amazon Redshift target, then the client-side encryption is used for data load. If you provide customer master key ID generated by AWS Key Management Service in the Amazon Redshift connection properties, then the server-side encryption is used for data load. To enable client-side encryption, perform the following tasks:

Provide the master symmetric key when you create an Amazon Redshift connection. Ensure that you provide a 256-bit AES encryption key in Base64 format.

Update the security policy JAR files to support encryption with maximum security.

Update the

local_policy.jar

and the

US_export_policy.jar

files in the following directory:

<Informatica Installation Directory>\ava\jre\lib\security

. You can download the JAR files supported by your JAVA environment from the Oracle website.

Select

Turn on S3 Client Side Encryption

as the encryption type in the target session properties.

Data Encryption in Amazon Redshift Targets