Table of Contents

Search

  1. Preface
  2. Part 1: Introduction to Amazon Redshift connectors
  3. Part 2: Data Integration with Amazon Redshift V2 Connector
  4. Part 3: Data Integration with Amazon Redshift Connector

Amazon Redshift Connectors

Amazon Redshift Connectors

Data encryption in Amazon Redshift V2 sources

Data encryption in Amazon Redshift V2 sources

To protect data, you can encrypt the data when you read the data from a source.
Select the type of the encryption in the
Encryption Type
field under the Amazon Redshift V2 advanced source properties on the
Schedule
page. The Unload command creates staging files on Amazon S3 for server-side encryption with the AWS-managed encryption keys and AWS Key Management Service key.
Use the customer master key ID generated by AWS Key Management Service in the Unload command for server-side encryption.
You can select the following types of encryption:
None
The data is not encrypted.
SSE-S3
If you select the
SSE-S3
encryption type, the Unload command creates the staging files in the Amazon S3 bucket and Amazon S3 encrypts the file using AWS-managed encryption keys for server-side encryption.
SSE-KMS
If you select the
SSE-KMS
encryption type, the Unload command creates the staging files in the Amazon S3 bucket and Amazon S3 encrypts the file using AWS KMS-managed customer master key or Amazon Resource Name (ARN) for server-side encryption.
The AWS KMS-managed customer master key or ARN that you specify in the connection property must belong to the same region where Amazon S3 is hosted.
For example, if Amazon S3 is hosted in the
US West (Oregon)
region, you must use the AWS KMS-managed customer master key enabled in the same region when you select the
SSE-KMS
encryption type.
CSE-SMK
If you select the
CSE-SMK
encryption type, Amazon Redshift uploads the data to the Amazon S3 server by using the master symmetric key and then loads the data by using the copy command with the encrypted option and a private encryption key for additional security.
You must provide a master symmetric key ID in the connection property to enable
CSE-SMK
encryption type.
Amazon Redshift V2 Connector does not support the server-side encryption with the master symmetric key and client-side encryption with the customer master key.