ALTER INSTANCE ROTATE INNODB MASTER KEY

Purpose

The ALTER INSTANCE ROTATE INNODB MASTER KEY statement is used to replace or rotate the primary encryption key of the primary tenant when Transparent Data Encryption (TDE) is in use. This statement does not accept any parameters and performs a single function: key rotation.

When ALTER INSTANCE ROTATE INNODB MASTER KEY is executed, a new primary key is generated to replace the current one. The new primary key is securely stored in a configured key store. All tablespaces encrypted with the old primary key will be gradually re-encrypted and switched to the new primary key.

Limitations and considerations

The system tenant cannot use the ALTER INSTANCE ROTATE INNODB MASTER KEY statement to replace or rotate the primary encryption key of the primary tenant.

If you are a regular tenant, you can use the ALTER INSTANCE ROTATE INNODB MASTER KEY statement to replace or rotate the primary encryption key of the primary tenant.

Syntax

ALTER INSTANCE ROTATE INNODB MASTER KEY

Parameters

Examples

/* Set the encryption method to internal TDE. */
obclient> ALTER SYSTEM SET tde_method='internal';
/* Display the current encryption method configuration. */
obclient> SHOW PARAMETERS LIKE 'tde_method';
/* Generate a new primary encryption key. */
obclient> ALTER INSTANCE ROTATE INNODB MASTER KEY;