The MySQL Keyring shell>  chmod 750 mysql-keyring shell>  chown mysql mysql-keyring shell>  chgrp mysql mysql-keyring At MySQL startup, set the  keyring_aws_conf_file  system variable to  /usr/local/mysql/ mysql-keyring/keyring_aws_conf  to indicate the configuration file location to the server. 5. Prepare the  keyring_aws  configuration file, which should contain two lines: •Line 1: The secret access key ID •Line 2: The secret access key For example, if the key ID is  wwwwwwwwwwwwwEXAMPLE  and the key is  xxxxxxxxxxxxx/yyyyyyy/ zzzzzzzzEXAMPLEKEY , the configuration file looks like this: wwwwwwwwwwwwwEXAMPLE xxxxxxxxxxxxx/yyyyyyy/zzzzzzzzEXAMPLEKEY To be usable during the server startup process,  keyring_aws  must be loaded using the  --early- plugin-load  option. The  keyring_aws_cmk_id  system variable is mandatory and configures the customer master key (CMK) ID obtained from the AWS KMS server. The  keyring_aws_conf_file and  keyring_aws_data_file  system variables optionally configure the locations of the files used by the  keyring_aws  plugin for configuration information and data storage. The file location variable default values are platform specific. To configure the locations explicitly, set the variable values at startup. For example, use these lines in the server  my.cnf  file, adjusting the  .so  suffix and file locations for your platform as necessary: [mysqld] early-plugin-load=keyring_aws.so keyring_aws_cmk_id=’arn:aws:kms:us-west-2:111122223333:key/abcd1234-ef56-ab12-cd34-ef56abcd1234’ keyring_aws_conf_file=/usr/local/mysql/mysql-keyring/keyring_aws_conf keyring_aws_data_file=/usr/local/mysql/mysql-keyring/keyring_aws_data For the  keyring_aws  plugin to start successfully, the configuration file must exist and contain valid secret access key information, initialized as described previously. The storage file need not exist. If it does not, keyring_aws  attempts to create it (as well as its parent directory, if necessary). For additional information about the system variables used to configure the  keyring_aws  plugin, see Section 6.4.4.18, “Keyring System Variables” . Start the MySQL server and install the functions associated with the  keyring_aws  plugin. This is a one- time operation, performed by executing the following statements, adjusting the  .so  suffix for your platform as necessary: For additional information about the  keyring_aws  functions, see Section 6.4.4.15, “Plugin-Specific Keyring Key-Management Functions” . CREATE FUNCTION keyring_aws_rotate_cmk RETURNS INTEGER SONAME ’keyring_aws.so’; CREATE FUNCTION keyring_aws_rotate_keys RETURNS INTEGER SONAME ’keyring_aws.so’; keyring_aws Operation At plugin startup, the  keyring_aws  plugin reads the AWS secret access key ID and key from its configuration file. It also reads any encrypted keys contained in its storage file into its in-memory cache. During operation,  keyring_aws  maintains encrypted keys in the in-memory cache and uses the storage file as local persistent storage. Each keyring operation is transactional:  keyring_aws  either successfully 1417