Data-at-Rest encryption in MySQL
Setup:

The data-at-rest encryption feature relies on a keyring plugin for master encryption key management.

We will be using docker approach to achieve data at rest encryption in MySQL, so that you can save some time for snacks! 😜

Step 1:

Clone the repository:

*We are using MySQL version 8.0, yes we always use latest ones 😉

Step 2:

Setup a keyring plugin:

Move to conf/my.cnf

Add the following lines to my.cnf to setup keyring plugin:

early-plugin-load=keyring_file.so keyring_file_data=/var/lib/mysql/keyring-data/keyring innodb_file_per_table=ON

Step 3:

Build and run customized docker image to repository

Navigate to root folder

Build the docker image:

sudo docker build -t <IMAGE_NAME>:<VERSION_ID> .

Run the docker image:

sudo docker run -d — name mysql <IMAGE_NAME>:<VERSION_ID>

Step 4:

Execute the running docker container:

sudo docker exec -it mysql bash

Step 5:

After moving inside the container, check for /etc/mysql/my.cnf contains same configuration as we had set.

sudo vim /etc/mysql/my.cnf

Step 6:

Login to mysql instance:

mysql -uroot -p

*Default password is no password

Step 7:

Create database and tables:

mysql> CREATE DATABASE databasename; mysql> CREATE TABLE table_name ( column1 datatype, column2 datatype, column3 datatype, …. );

Step 8:

Insert some data:

mysql> INSERT INTO table_name (column1, column2, column3, …) VALUES (value1, value2, value3, …);

Step 9:

We have data in place, now we will move to encrypting this data at rest 😇

Check for the keyring plugin is in place:

If you didn’t get required output, please follow step:

mysql> INSTALL PLUGIN keyring_file SONAME ‘keyring_file.so’;

Step 10:

The default_table_encryption variable can be set for an individual client connection or globally using SET syntax.

The following statement enables default schema and tablespace encryption globally:

mysql> SET GLOBAL default_table_encryption=ON;

Step 11:

To encrypt particular table at-rest, first select the database:

mysql> use databasename;

Step 12:

To alter the encryption of an existing general tablespace, an ENCRYPTION clause must be specified:

mysql> ALTER TABLE table_name ENCRYPTION = ‘Y’;

Step 13:

Validate the encryption:

Our output should look like below:

Voilaa!!🥳 this is how we encrypted data at-rest in MySQL 😎
['Shubham Khairnar']
['MySQL', 'Encryption', 'Data At Rest', 'Docker', 'Data']