Backup encryption

Procedure

1. Obtain the ciphertext and encryption algorithm of the backup set.

   1. Go to the RDS Instances page, select a region in the top navigation bar, and then click the ID of the target instance.

   2. In the left-side navigation pane, click Backup Recovery.

   3. On the Backup Recovery page, go to the Base Backups > Data Backup tab.

   4. In the Action column of the target backup set, click > View Encryption Information to obtain the Ciphertext and Encryption Algorithm.

2. Call the Decrypt API operation. In the CiphertextBlob parameter, pass the Ciphertext that you obtained in Step 1 to get the Base64-encoded binary string Plaintext.

   {
     "KeyId": "xxx",
     "KeyVersionId": "xxx",
     "Plaintext": "S14dTb16i4Qo",
     "RequestId": "7474865d-f1fc-49c8-bf4d-7323de86ce59"
   }

3. Base64-decode the Plaintext string and convert the resulting bytes to hexadecimal to obtain the decryption key. This example uses a Python 3 script to do this.

   1. Run vi decrypt.py in the command-line interface to open the vi editor.

   2. Press i to enter insert mode. Enter the following content, press ESC, and then enter :wq to save the file and exit.

      import base64
      import binascii
      plaintext = 'S14dTbl6i4Qo**********'  # Enter the Plaintext that you obtained in the preceding step between the single quotation marks ('').
      password = binascii.b2a_hex(base64.b64decode(plaintext))   # Obtain the decryption password and assign it to the password variable.
      print(str(password, 'utf-8'))   # Print the password as a string.
                    

   3. Run the python decrypt.py command. The command prints the decryption key. The following is a sample key:

      4b5e1d4db97a********************

4. Download the encrypted backup data and then decrypt the data.

   1. Download the backup data to a local machine.

   2. Run the following command to create a directory, for example, /home/mysql/data, to store the backup data.

      mkdir /home/mysql/data

   3. Decompress the package. Choose a decompression command based on the file suffix.

      File type	Decompression command
      tar package (.tar.gz)	tar -izxvf test1.tar.gz -C /home/mysql/data
      xbstream package (.xb.gz)	gzip -d -c test1.xb.gz | xbstream -x -v -C /home/mysql/data
      xbstream file package (_qp.xb)	## Unpack the file first. cat test1_qp.xb | xbstream -x -v -C /home/mysql/data ## Then, decompress the file. ### For MySQL 5.6/5.7 innobackupex --decompress --remove-original /home/mysql/data ### For MySQL 8.0 xtrabackup --decompress --remove-original --target-dir=/home/mysql/data
      xbstream qpress package (_xb.qp)	qpress -do test1_xb.qp | xbstream -x -v -C /home/mysql/data

      After decompression, most data files have the .xbcrypt suffix, indicating they are encrypted.

      backup-my.cnf.xbcrypt        testdb
      dbfortest                     xtrabackup_binlog_info.xbcrypt
      ibdata1.xbcrypt               xtrabackup_checkpoints
      mysql                         xtrabackup_info.xbcrypt
      performance_schema            xtrabackup_logfile.xbcrypt
      rds_table_info_json_105244.log  xtrabackup_slave_filename_info.xbcrypt
      _recycle_bin_                 xtrabackup_slave_info.xbcrypt

   4. Run the following command to decrypt the data.

      xtrabackup --decompress --remove-original --decrypt=AES256 --encrypt-key=4b5e1d4db97a******************** --target-dir=/home/mysql/data

      Note

      Key parameters:

      • decrypt: The Encryption Algorithm that you obtained in Step 1. In this example, the value is AES256.

      • encrypt-key: The decryption password that you obtained in Step 3.

      • target-dir: The directory where the backup files are stored.

      After the command runs, the .xbcrypt suffix disappears from the filenames, confirming the data is decrypted.

      backup-my.cnf            testdb
      dbfortest                xtrabackup_binlog_info
      ibdata1                  xtrabackup_checkpoints
      mysql                    xtrabackup_info
      performance_schema       xtrabackup_logfile
      rds_table_info_json_105244.log  xtrabackup_slave_filename_info
      recycle_bin              xtrabackup_slave_info