The AWS Advanced JDBC Wrapper added a KMS Encryption plugin that encrypts sensitive data within Java applications before writing to Amazon Aurora or RDS open source databases. This approach prevents plaintext exposure inside the database engine, mitigating risks from credential compromise or SQL injection attacks and aiding compliance with regulations like PCI DSS, HIPAA, and GDPR.
The plugin operates transparently at the JDBC driver level, requiring no application code changes and supports PostgreSQL and MySQL-compatible engines. Encrypted columns are verifiable via HMAC by the database without requiring encryption keys. The solution is offered open source under Apache 2.0, but independent security audits or benchmarks were not cited in the source.
Source & further reading
AWS Advanced JDBC Wrapper now provides client-side encryption ↗Source published 2026-05-07. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.