Revisit how an already TDE-enabled cluster's data encryption key is protected: add protection you skipped at creation time, or rotate the key or passphrase currently in use.
Protecting an existing key shows how to add a protection mechanism to a key that was left unprotected when the cluster was created.
Rotating the key shows how to change the passphrase or key-store wrapping key currently protecting your data encryption key.
If you're choosing a protection mechanism for a new cluster instead, see Choosing a key protection mechanism.
Protecting an existing key
Learn how to enable a mechanism to protect the data encryption key on an existing TDE-enabled database cluster.
Rotating the key
Learn how to rotate your data encryption key.