ActiveRecord column encryption migration

2 posts · Oct 2022 – Nov 2022

What this trail covers

This feature thread tracks the evolution of encrypting sensitive database columns using ActiveRecord. Initially, the focus was on designing a paved path for easy-to-use column encryption. This post details the migration strategy for converting existing plaintext or previously encrypted data to the new ActiveRecord encryption standard, including handling key rotation and the use of a previous encryptor strategy and feature flags for safe rollout. It also introduces the MaintenanceTasks gem for better management.

All GitHub trails

Nov 2022How GitHub converts previously encrypted and unencrypted columns to ActiveRecord encrypted columnsThis post details the technical implementation of migrating existing plaintext and previously encrypted database columns to ActiveRecord encrypted columns. It covers the design decisions for a simplified migration pattern, including the use of `ActiveRecord::Encryption`'s previous encryptor strategy to isolate plaintext mode to specific models, and a feature flag mechanism to control encryption rollout. It also addresses a caveat with `changed_in_place?` when migrating from deprecated internal encryption and explains how key rotation is handled by adding new keys and re-encrypting records.
Oct 2022Why and how GitHub encrypts sensitive database columns using ActiveRecord::EncryptionThis post details the migration strategy for converting existing plaintext or previously encrypted data to the new ActiveRecord encryption standard. It covers handling key rotation and the use of a previous encryptor strategy and feature flags for safe rollout. It also introduces the MaintenanceTasks gem for better management.
Advertisement