title: How to encrypt data in AWS RDS with AWS KMS on the column level?
body: <p>I found that <a href="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html" rel="nofollow noreferrer">AWS RDS allows encrypting DB resources</a> with AWS KMS. Because it is done inside the AWS infrastructure the encryption key can be easily rotated automatically. It is cool, but it is only encryption-at-rest. </p>
  
  <p>I would additionally like to have encrypted some particular columns in the database. For example SSN. I would like to store them encrypted and decrypt them to display inside my application. Moreover, I would like to have an individual key for every user.</p>
  
  <p>The main problem which I observed will be the rotation of the key. As I'm thinking to rotate the key for one user I would like to do this inside my application:</p>
  
  <ul>
  <li>get a current encryption key from KMS</li>
  <li>decrypt all the data from RDS encrypted with the current key</li>
  <li>generate a new encryption key</li>
  <li>encrypt everything again and store data in RDS</li>
  <li>store the new key in the KMS</li>
  </ul>
  
  <p>The main problem here would be to keep everything in a "transaction" - to "commit" if everything was fine and to "rollback" everything if anything went wrong.</p>
  
  <p>I wonder if such keys rotation for the encryption at the columns level could be done inside the AWS infrastructure automatically. Do you have any ideas about that? Maybe you know any other, better approach for such a situation?</p>