|
| 1 | +# Plaintext DynamoDB Table to AWS Database Encryption SDK Encrypted Table Migration |
| 2 | + |
| 3 | +This projects demonstrates the steps necessary |
| 4 | +to migrate to the AWS Database Encryption SDK for DynamoDb |
| 5 | +from a plaintext database. |
| 6 | + |
| 7 | +[Step 0](plaintext/step0.go) demonstrates the starting state for your system. |
| 8 | + |
| 9 | +## Step 1 |
| 10 | + |
| 11 | +In Step 1, you update your system to do the following: |
| 12 | + |
| 13 | +- continue to read plaintext items |
| 14 | +- continue to write plaintext items |
| 15 | +- prepare to read encrypted items |
| 16 | + |
| 17 | +When you deploy changes in Step 1, |
| 18 | +you should not expect any behavior change in your system, |
| 19 | +and your dataset still consists of plaintext data. |
| 20 | + |
| 21 | +You must ensure that the changes in Step 1 make it to all your readers before you proceed to Step 2. |
| 22 | + |
| 23 | +## Step 2 |
| 24 | + |
| 25 | +In Step 2, you update your system to do the following: |
| 26 | + |
| 27 | +- continue to read plaintext items |
| 28 | +- start writing encrypted items |
| 29 | +- continue to read encrypted items |
| 30 | + |
| 31 | +When you deploy changes in Step 2, |
| 32 | +you are introducing encrypted items to your system, |
| 33 | +and must make sure that all your readers are updated with the changes from Step 1. |
| 34 | + |
| 35 | +Before you move onto the next step, you will need to encrypt all plaintext items in your dataset. |
| 36 | +Once you have completed this step, |
| 37 | +while new items are being encrypted using the new format and will be authenticated on read, |
| 38 | +your system will still accept reading plaintext, unauthenticated items. |
| 39 | +In order to complete migration to a system where you always authenticate your items, |
| 40 | +you should prioritize moving on to Step 3. |
| 41 | + |
| 42 | +## Step 3 |
| 43 | + |
| 44 | +Once all old items are encrypted, |
| 45 | +update your system to do the following: |
| 46 | + |
| 47 | +- continue to write encrypted items |
| 48 | +- continue to read encrypted items |
| 49 | +- do not accept reading plaintext items |
| 50 | + |
| 51 | +Once you have deployed these changes to your system, you have completed migration. |
0 commit comments