Table of Contents

Search

  1. Preface
  2. Part 1: Introduction to Amazon Redshift connectors
  3. Part 2: Data Integration with Amazon Redshift V2 Connector
  4. Part 3: Data Integration with Amazon Redshift Connector

Amazon Redshift Connectors

Amazon Redshift Connectors

Data encryption in Amazon Redshift sources

Data encryption in Amazon Redshift sources

You can encrypt data using the customer master key ID generated by AWS Key Management Service (AWS KMS) for server-side encryption.
You can select the type of the encryption in the
Encryption Type
field under the Amazon Redshift advanced source properties on the
Schedule
page. The Unload command creates staging files on Amazon S3 for server-side encryption with the AWS-managed encryption keys and AWS Key Management Service key.
Use the customer master key ID generated by AWS Key Management Service in the Unload command for server-side encryption. You can select the following types of encryption:
SSE-S3
If you select the
SSE-S3
encryption type, the Unload command creates the staging files in the Amazon S3 bucket and Amazon S3 encrypts the file using AWS-managed encryption keys for server-side encryption.
SSE-KMS
If you select the
SSE-KMS
encryption type, the Unload command creates the staging files in the Amazon S3 bucket and Amazon S3 encrypts the file using AWS KMS-managed customer master key for server-side encryption.
The AWS KMS-managed customer master key specified in the connection property must belong to the same region where Amazon S3 is hosted. For example, if Amazon S3 is hosted in the
US West (Oregon)
region, you must use the AWS KMS-managed customer master key enabled in the same region when you select the
SSE-KMS
encryption type.
If you enable the
Turn on S3 Client Side Encryption
property and select the
Encryption Type
as
SSE-S3
, the Amazon S3 encrypts the data using the master symmetric key for client-side encryption.
If you enable the
Turn on S3 Client Side Encryption
property and select the
Encryption Type
as
SSE-KMS
, the Amazon S3 encrypts the data using the customer master key ID generated by AWS Key Management Service for server-side encryption.
Amazon Redshift Connector does not support the server-side encryption with the master symmetric key and client-side encryption with the customer master key.