Backing Up the TDE Certificate from the Source RDS Instance

To restore a Transparent Data Encryption (TDE)–encrypted database between Amazon RDS for SQL Server instances, you must back up and restore the TDE certificate outside of Commvault before restoring the database.

Before you begin, make sure that the following requirements are met:

- TDE is enabled on the target RDS instance.

- You have sufficient permissions to run Amazon RDS stored procedures.

- You have secure storage available for the TDE certificate and private key backup files.

Procedure

1. Connect to the source RDS instance.

2. Run the msdb.dbo.rds_backup_tde_certificate stored procedure.

3. Securely store the exported certificate and private key files.

   For more information see the Amazon RDS documentation for SQL Server TDE certificate restore.

Back Up the TDE-Encrypted Database

1. Perform a backup of the encrypted database in Commvault.

   For more information see, Backing Up an Amazon RDS for SQL Server Instance On Demand.

Restore the TDE Certificate to the Target RDS Instance

Before restoring the encrypted database, restore the certificate to the target RDS instance:

1. Connect to the target RDS instance.

2. Run the msdb.dbo.rds_restore_tde_certificate stored procedure.

3. Provide the certificate and private key files that were previously backed up.

4. Verify that the certificate is successfully restored.

   For more information see Backing up and restoring TDE certificates on RDS for SQL Server.

Restore the TDE-Encrypted Database

After restoring the certificate, restore the database backup:

For instructions, see Restoring an Amazon RDS for SQL Server Database.