Having some trouble finding a workable solution for MariaDB key management.
In the words of one of our devops guys - "File key management is somewhat akin to taping your car's key to the windscreen". So, we are looking for a secure way to implement data-at-rest encryption, but we are having trouble with both of the other options listed in the documentation.
AWS KMS
The MariaDB documentation states the following:
The AWS Key Management plugin depends on the AWS SDK for C++, which uses the Apache License, Version 2.0. This license is not compatible with MariaDB Server's GPL 2.0 license, so we are not able to distribute packages that contain the AWS Key Management plugin. Therefore, the only way to currently obtain the plugin is to install it from source.
Our servers are managed, and the response we received from the devops team was:
Building things from source is quite an anti-pattern within the context of a Puppet-managed environment, so we need to figure out if this is doable in a sane and sustainable way
Eperi Key Management
The MariaDB documentation states the following:
It reads encryption keys from eperi Gateway for Databases.
I contacted Eperi to get information about their Gateway for Databases solution, and this was the response I received from their sales team:
We will not be able to serve you. Please look for another way.
So Im at a bit of a dead end here :( Has anybody in a similar situation been able to find a workable solution?