SQL Server Always Encrypted on AWS RDS

Question

Does anyone know if RDS for SQL Server supports Always Encrypted? If it does has anyone every used AWS KMS as the Certificate Store?

Answer 1

RDS for SQL Server supports Always Encrypted. It is mentioned in the documentation: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html

AWS KMS can't be used for the Certificate store. The options are:

• Azure Key Vault
• Windows Certificate Store on a client machine
• Hardware security module

RDS also supports Always Encrypted with Secure Enclaves, but with some limitations in regards to the setup: https://aws.amazon.com/blogs/modernizing-with-aws/sql-server-always-encrypted-with-secure-enclaves/