-- Enable encryption at rest for PostgreSQL
ALTER SYSTEM SET shared_preload_libraries = 'pg_tde';

-- Create encrypted tablespace
CREATE TABLESPACE encrypted_space 
LOCATION '/var/lib/postgresql/encrypted'
WITH (encryption_key_id = 'master-key-001');

-- Create table in encrypted tablespace
CREATE TABLE sensitive_data (
    id SERIAL PRIMARY KEY,
    ssn VARCHAR(11) ENCRYPTED,
    credit_card VARCHAR(19) ENCRYPTED
) TABLESPACE encrypted_space;

# my.cnf configuration for MySQL encryption at rest
[mysqld]
# Enable InnoDB encryption
innodb_encrypt_tables=ON
innodb_encrypt_log=ON
innodb_encryption_threads=4
innodb_encryption_rotate_key_age=1

# Key ring plugin configuration
early-plugin-load=keyring_encrypted_file.so
keyring_encrypted_file_data=/var/lib/mysql-keyring/keyring-encrypted
keyring_encrypted_file_password=SecurePassword123!

// MongoDB encryption at rest configuration
// mongod.conf (YAML format)
security:
  enableEncryption: true
  encryptionCipherMode: AES256-CBC
  encryptionKeyFile: /etc/mongodb-keyfile

// Application-level field encryption
const clientEncryption = new ClientEncryption(keyVault, {
  keyVaultNamespace: 'encryption.__keyVault',
  kmsProviders: {
    aws: {
      accessKeyId: process.env.AWS_ACCESS_KEY_ID,
      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY
    }
  }
});

// Encrypt sensitive field
const encryptedSSN = await clientEncryption.encrypt('123-45-6789', {
  algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic',
  keyId: dataKey
});

# CloudFormation template for encrypted RDS
Resources:
  EncryptedDatabase:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceClass: db.t3.micro
      Engine: postgres
      StorageEncrypted: true
      KmsKeyId: !Ref DatabaseKMSKey
      DeletionProtection: true
      BackupRetentionPeriod: 30

  DatabaseKMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: "RDS Database Encryption Key"
      KeyPolicy:
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "kms:*"
            Resource: "*"
          - Effect: Allow
            Principal:
              Service: rds.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:GenerateDataKey
            Resource: "*"

# PowerShell script for Azure SQL TDE configuration
# Enable Transparent Data Encryption with customer-managed key
$keyVault = "my-key-vault"
$keyName = "sql-tde-key"
$resourceGroup = "my-resource-group"
$serverName = "my-sql-server"
$databaseName = "my-database"

# Create key in Key Vault
$key = Add-AzKeyVaultKey -VaultName $keyVault -Name $keyName -Destination Software

# Set server identity and permissions
Set-AzSqlServer -ResourceGroupName $resourceGroup -ServerName $serverName -AssignIdentity
Set-AzKeyVaultAccessPolicy -VaultName $keyVault -ObjectId $serverIdentity -PermissionsToKeys get,wrapKey,unwrapKey

# Enable TDE with customer key
Set-AzSqlServerTransparentDataEncryptionProtector -ResourceGroupName $resourceGroup -ServerName $serverName -Type AzureKeyVault -KeyId $key.Id
Set-AzSqlDatabaseTransparentDataEncryption -ResourceGroupName $resourceGroup -ServerName $serverName -DatabaseName $databaseName -State Enabled

#!/bin/bash
# Set up LUKS encryption for data partition

# Create encrypted partition
cryptsetup luksFormat /dev/sdb1 --cipher aes-xts-plain64 --key-size 512 --hash sha256

# Open encrypted partition
cryptsetup luksOpen /dev/sdb1 encrypted_data

# Create filesystem
mkfs.ext4 /dev/mapper/encrypted_data

# Add to crypttab for automatic mounting
echo "encrypted_data /dev/sdb1 /root/keyfile luks" >> /etc/crypttab
echo "/dev/mapper/encrypted_data /mnt/encrypted ext4 defaults 0 2" >> /etc/fstab

# Python example using Fernet (symmetric encryption)
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import base64
import os

class DataEncryption:
    def __init__(self, password: bytes, salt: bytes = None):
        if salt is None:
            salt = os.urandom(16)

        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            iterations=100000,
        )
        key = base64.urlsafe_b64encode(kdf.derive(password))
        self.cipher = Fernet(key)
        self.salt = salt

    def encrypt_data(self, data: str) -> bytes:
        return self.cipher.encrypt(data.encode())

    def decrypt_data(self, encrypted_data: bytes) -> str:
        return self.cipher.decrypt(encrypted_data).decode()

# Usage example
encryptor = DataEncryption(b"secure_password_123")
encrypted = encryptor.encrypt_data("sensitive information")

#!/usr/bin/env python3
import boto3
from datetime import datetime, timedelta

def rotate_kms_keys():
    kms = boto3.client('kms')

    # List all customer-managed keys
    keys = kms.list_keys()

    for key in keys['Keys']:
        key_id = key['KeyId']

        # Get key metadata
        key_metadata = kms.describe_key(KeyId=key_id)['KeyMetadata']

        # Skip AWS managed keys
        if key_metadata['KeyManager'] == 'AWS':
            continue

        # Check if key is older than 365 days
        creation_date = key_metadata['CreationDate']
        if datetime.now(creation_date.tzinfo) - creation_date > timedelta(days=365):
            print(f"Rotating key: {key_id}")

            # Enable automatic key rotation
            kms.enable_key_rotation(KeyId=key_id)

            # Create new key version
            kms.rotate_key_on_demand(KeyId=key_id)

if __name__ == "__main__":
    rotate_kms_keys()

# Prometheus monitoring for encryption metrics
apiVersion: v1
kind: ConfigMap
metadata:
  name: encryption-monitoring
data:
  alerts.yaml: |
    groups:
    - name: encryption-alerts
      rules:
      - alert: EncryptionKeyRotationOverdue
        expr: time() - kms_key_last_rotation_timestamp > 86400 * 365
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: "KMS key rotation is overdue"

      - alert: UnencryptedDatabaseDetected
        expr: database_encryption_enabled == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Unencrypted database detected"