Search code examples
encryptionamazon-s3amazon-rdsamazon-auroraamazon-kms

Select AWS RDS Aurora into S3 encrypted bucket with KMS

I'm trying to use AWS RDS Aurora functionality SELECT * INTO OUTFILE S3 :some_bucket/object_key where some_bucket has default Server-side encryption with KMS.

I'm receiving this error, which makes sense:

InternalError: (InternalError) (1871, u'S3 API returned error: Unknown:Unable to parse ExceptionName: KMS.NotFoundException Message: Invalid keyId')

How can I make this work, make Aurora have the KMS key so that it can upload a file into S3?

Solution

  • As per the documentation

    https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.SaveIntoS3.html#AuroraMySQL.Integrating.SaveIntoS3.Statement

    Compressed or encrypted files are not supported.

    But you could create an exception policy for the bucket with "NotResource" policy for particular suffix and select into that, from there you could trigger an lambda to move the file to actual path with encryption.