Configure Encryption for Data At Rest

This skill configures encryption at rest for storage systems, databases, and cloud services - encryption algorithms, key management, compliance requirements, and security best practices for protecting stored data. Core standards: AES-256 as the minimum for new implementations, hardware-accelerated encryption (AES-NI) where available, envelope encryption for large datasets (data keys encrypted by master keys), authenticated encryption modes (GCM, CCM) to prevent tampering, and proper random IV/nonce generation per operation. The key-management hierarchy runs root keys (in HSMs or cloud KMS), master keys (encrypting data encryption keys), and data encryption keys (used for the actual encryption, rotated regularly), with key derivation via PBKDF2, scrypt, or Argon2 where applicable.

Use it when data at rest - in a database, a cloud-managed service, a filesystem, or application code - needs encryption configured to a specific standard rather than left to a platform default.

class DataEncryption:
    def __init__(self, password: bytes, salt: bytes = None):
        if salt is None:
            salt = os.urandom(16)
        kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=100000)
        key = base64.urlsafe_b64encode(kdf.derive(password))
        self.cipher = Fernet(key)

Database-specific configuration is shown for PostgreSQL (encrypted tablespaces via pg_tde), MySQL (InnoDB table/log encryption with a keyring plugin), and MongoDB (enableEncryption with AES256-CBC, plus application-level field encryption via a KMS-backed ClientEncryption client). Cloud examples cover AWS RDS (a CloudFormation template with StorageEncrypted: true and a dedicated KMS key policy) and Azure SQL (a PowerShell script enabling Transparent Data Encryption with a customer-managed Key Vault key). Filesystem-level encryption is shown via Linux LUKS (cryptsetup luksFormat/luksOpen, crypttab for automatic mounting), and a Python DataEncryption class wraps Fernet symmetric encryption with a PBKDF2-derived key. Key rotation is automated with a boto3 script that finds customer-managed KMS keys older than 365 days and rotates them, and Prometheus alerting rules watch for overdue key rotation and unencrypted databases. A compliance checklist covers regulatory algorithm requirements (FIPS 140-2, Common Criteria), key escrow/recovery, encrypted backups with separate key management, and secure key destruction.

Security and platform engineers who need concrete, working encryption-at-rest configuration for a specific database, cloud service, or filesystem - plus key rotation automation and compliance monitoring - rather than a generic "enable encryption" checkbox. Performance guidance rounds it out: use AES-NI hardware acceleration where available, pool connections for encrypted database access, consider column-level encryption for selective protection instead of encrypting everything, watch for the roughly 2-10% CPU overhead typical on modern systems, and compress data before encrypting it for better space and throughput.