Can I hide my password for data at rest encryption key?

Question

For MariaDB encryption at-rest, my setting is

[mysqld]
# at-rest encryption
plugin_load_add = file_key_management
file_key_management_filename = /etc/mysql/rest/keyfile.enc
file_key_management_filekey = FILE:/etc/mysql/rest/keyfile.passwd
file_key_management_encryption_algorithm = AES_CBC

However, if hackers steals the database, they has access to both keyfile.enc and keyfile.passwd and the point of encryption at-rest is useless.

Can I tell the key manager not to read the super password from the file. Instead, read it from the user at the startup?

• danblack: The only options are those documented

Answer 1

Usually database is started as a service in background, so entering keys at startup will not be possible.

To separate key(s) and data you have the following options:

• store keys on a separate device which can be unplugged after start of database server.
• use an external key management system, e.g Eperi which also supports key rotation.

• mercury: Is AWS Key Management Plugin similar to Eperi in this sense? There is no much information in the link about how Eperi connects to another server. A bit hard to evaluate it.