Now, let's say you need to retrieve honey from the bee galactic reserve. This bank is the most regulatory bank on Mars where be store their valuable honey. The bee galactic active reserve store the database upon a transactions in a private subnet, AWS VPC. To get there, you need to send your request to the load balancer which will distribute your request to one of the web servers. The web server's, after validating the request will send it to an internal load balancer to distribute your requests to the application servers. This application server will then talk to the database upon a transactions to get information about you and your money such as, how much honey are you allowed to withdraw per day? Now, if you look at the process, you see that the load balancer and a web servers are in public subnet that allow requests from the Internet, and the internal load balancer and application server will be in private subnet and only allow requests from the web server. Also, the database is placed in private subnets as well and will only take requests prompt application servers. This architecture is to make sure the Internet doesn't have access to your database. Depending on the data classification, sometimes running our database in DPC private subnet isn't sufficient. For example, if you handle data related to customer credit card information, then encrypting data address is essential to prevent data links. In this video, we'll talk about how you can encrypt data store in AWS database services. For SQL lovers, you may already have heard or know about it AWS relational database service or RDS. It is a managed service that make it easier to setup, operate, and scale all relational database in the Cloud. You can use SSL from your application to encrypt a connection to an RDS DB Instance running Amazon Aurora, MySQL, MariaDB, SQL Server, Oracle or Postgres. Each DB engine has it own process of implementing SSL. In case you are wondering, Amazon Aurora is a relational database service which features are distributed fault tolerant, self-healing storage system that can auto scale up to 64 terabytes per database instance. The best part is, it is compatible with MySQL and Postgres database engines. You can encrypt your Amazon RDS, DB Instance and snapshot addressed by enabling the encryption option when you create Amazon RDS DB Instance. RDS encrypted DB Instance use the industry standards AES-256 encryption algorithm to encrypt your data on the server that hosts your DB Instance. So what will be encrypted? You ask. Data that is encrypted at rest include the underlying storage for DB Instance, it's automated backup, Read Replicas, and snapshot. To manage the key you for encrypting and decrypting your RDS resource, you use, it appears key management service or KMS in short. When you create an encrypted DB Instance, you supply the KMS key identifier for your encryption key. If you don't have your old key, KMS will create one for you. What if you choose to use NoSQL database?. Then it's time to talk about it appears managed NoSQL database service code DynamoDB. The good news is, Amazon DynamoDB encrypts all user data, store in DynamoDB table by default. Server side encryption at rest is enabled for all DynamoDB table data and can not be disabled. You cannot encrypt only a subset of items in a table though. When a table is encrypted, all the data includes as primary key, index, stream, Global table, backups will be encrypted. Encryption at rest integrate with AWS KMS for managing the encryption key that is used to encrypt your tables and you can switch between keys. Checkout our resource area for further details and documentation. That's it for now, happy seeing you.