Changing cluster encryption

You can modify an unencrypted cluster to use Amazon Key Management Service (Amazon KMS) encryption, using either an Amazon-managed key or a customer managed key. When you modify your cluster to enable Amazon KMS encryption, Amazon Redshift automatically migrates your data to a new encrypted cluster. You can also migrate an unencrypted cluster to an encrypted cluster by modifying the cluster.

During the migration operation, your cluster is available in read-only mode, and the cluster status appears as resizing.

If your cluster is configured to enable cross-Amazon Region snapshot copy, you must disable it before changing encryption. For more information, see Copying a snapshot to another Amazon Region and Configuring cross-Region snapshot copy for an Amazon KMS–encrypted cluster. You can't enable hardware security module (HSM) encryption by modifying the cluster. Instead, create a new, HSM-encrypted cluster and migrate your data to the new cluster. For more information, see Migrating to an HSM-encrypted cluster.