Configure Encryption for Data At Rest

This profile organizes encryption-at-rest work across databases, filesystem storage, cloud services, and application code. It addresses the relationship between encryption algorithms, key management, recovery, compliance requirements, monitoring, and performance. Configuration patterns span PostgreSQL-related encryption, MySQL, MongoDB, AWS RDS, Azure SQL, Linux LUKS, and Python application encryption.

Its key hierarchy separates root keys held in an HSM or cloud KMS, master keys that protect data encryption keys, and DEKs that encrypt stored data. Envelope encryption is proposed for large datasets. The principles also discuss authenticated modes, random IV or nonce generation, hardware acceleration, and password-based derivation with PBKDF2, scrypt, or Argon2 where applicable.

Use it to structure an encryption implementation plan or review which storage layers and keys require protection. Database-level, volume-level, and application-level examples represent different parts of that plan. Selecting one example does not establish that every copy of sensitive data, backup, or key is protected.

The supplied snippets are configuration examples, not evidence that a deployment was tested or meets a regulatory requirement. Platform-specific SQL, plugins, cloud identities, key policies, paths, and credentials require review in their target environment. The LUKS example includes partition formatting and filesystem creation, so it should not be treated as an inspection-only command sequence.

Inputs include the storage or database platform, intended encryption layer, key hierarchy, access policy, recovery needs, and applicable requirements. Outputs may include reviewed database settings, cloud resource configuration, encrypted-volume procedures, application encryption code, key-rotation plans, and monitoring rules. The application example uses these libraries:

from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import base64
import os

Cloud patterns address encrypted RDS storage with a KMS key and Azure SQL transparent data encryption with a Key Vault key. MongoDB material includes storage encryption and application field encryption. The Python example derives a Fernet key from a password and salt, while an AWS example examines customer-managed keys and enables rotation.

The operational checklist includes escrow and recovery, encrypted backups with separate key management, documented policies, penetration testing, key-use monitoring, and secure destruction. Prometheus examples flag overdue rotation and an unencrypted database. These are monitoring patterns whose metrics and thresholds need an actual implementation.

Performance considerations include AES-NI, selective column protection, connection pooling, CPU monitoring, memory mapping, caching, and compression before encryption. Illustrative overhead figures cannot establish performance for a specific workload, deployment, or encryption configuration.