Purpose
The ALTER INSTANCE ROTATE INNODB MASTER KEY statement is used to change or rotate the master encryption key for the primary tenant when Transparent Data Encryption (TDE) is in use. This statement does not accept any parameters and performs a single function: key rotation.
When ALTER INSTANCE ROTATE INNODB MASTER KEY is executed, a new master key is generated to replace the current one. The new master key is securely stored in a configured key store. All tablespaces encrypted with the old master key will be gradually re-encrypted and switched to the new master key.
Limitations and considerations
The system tenant cannot use this statement.
The system tenant is not allowed to use the ALTER INSTANCE ROTATE INNODB MASTER KEY statement to change or rotate the master encryption key for the primary tenant.
If you are a regular tenant, you can use the ALTER INSTANCE ROTATE INNODB MASTER KEY statement to change or rotate the master encryption key for the primary tenant.
Syntax
ALTER INSTANCE ROTATE INNODB MASTER KEY;
Parameters
| Field | Description |
|---|---|
| ROTATE | Generate a new key to replace the old key. |
| INNODB MASTER KEY | The master encryption key used by the InnoDB storage engine in MySQL mode to encrypt tablespaces in the database. |
Examples
/* Set the encryption method to internal TDE. */
obclient> ALTER SYSTEM SET tde_method='internal';
/* Display the current encryption method configuration. */
obclient> SHOW PARAMETERS LIKE 'tde_method';
/* Generate a new master encryption key. */
obclient> ALTER INSTANCE ROTATE INNODB MASTER KEY;