Database backup files are important files that support the data security and stability of the database. To improve the security of database backup files, RDS for MySQL supports encrypting backup files. If the encrypted backup file is downloaded to local use, the backup file needs to be decrypted. This topic introduces the operation steps for decrypting backup files.

Prerequisites

The target backup file has been downloaded to the local. For more detailed information about downloading data backup files, see Downloading data backup files; for more detailed information about downloading log backup files, see Downloading binlog backups.

The key of the target backup file has been downloaded to the local. For more detailed information about downloading backup file keys, please see Downloading backup file keys.

Steps

Decrypt data backup files

Store the data backup file and the key of the data backup file in the same directory.

View the key in the key through the cat command.

Create a MySQL data directory.

Perform xbstream decryption.

xbstream -x -v --decompress --decrypt=AES256 --encrypt-key='fa5056474928d5cfe2eeff02edcaceff' -C mysql_data < full-1713236719753042916.xbstream

After decompression is completed, confirm that the data in the data directory has been decompressed correctly.

Decrypt binlog backups

Store the binlog backup file and the key of the binlog backup file in the same directory.

View the secret key and vector saved in the key, and obtain the corresponding hexadecimal value through xxd.

key=`echo -n b2afbc4c598bf9f613a9b07d128818e3 | xxd -p | tr -d '[:space:]'`

iv=`echo -n b56727bcdf6be13e | xxd -p | tr -d '[:space:]'`

Decrypt the file through openssl.

openssl enc -d -aes-256-cbc -K $key -iv $iv -in binlog-1713237686709023371-binlog.000014 -out binlog.000014

Verify the correctness of the binlog backup file.

mysqlbinlog -vv binlog.000014

Last updated: 2025.06.30 12:08:37

Public security network record in Beijing: No. 11010802032137