Encryption at rest on AWS EC2 instances

• sqlPirate_Fl

  SSC-Addicted

  Points: 442

  More actions

  October 30, 2018 at 2:39 pm

  #416413

  Good day all, it's been a long time since I've post on here.

  First let me paint the scenario.  I'd like to move to an EC2 instance, one with the NVMe SSD (thinking an I3 instance in Amazon lingo).  From what I've read, the NVMe drives are encrypted (or can be) with XTS-AES-256.  The goal is to install Windows Server 2016 as the host OS and SQL Server 2016 standard (due to costs, Enterprise is a little out of reach).

  In your experience, is it sufficient enough to operate your SQL Server data files and logs on one of these NVMe encrypted drives and meet the requirements of having the data encrypted at rest?  Archives will be stored on an EBS drive or something equivalent as they wouldn't need the speed of the NVMe (or the cost associated with it). 

  The documentation I've read, so far, only mentioned Linux with kernel 3.8 being the ideal host OS, which would require SQL Server 2017, and I'd lose integration services.  But baring that Windows isn't incompatible, has anyone on here dealt with this scenario and met the encryption at rest requirements?

  Thank you for your time