Amazon patents method to update database encryption without downtime

1. A system, comprising: at least one processor; and a memory, storing program instructions that when executed by the at least one processor, cause the at least one processor to implement a database system, configured to: receive a query that causes one or more data blocks of a plurality of data blocks in a storage system storing a database to be read, wherein the database is in a transition state to a new encryption scheme; evaluate metadata comprising individual encryption transition state maintained as part of transitioning to the new encryption scheme for the plurality of data blocks to determine that the one or more data blocks have not been encrypted according to the new encryption scheme, wherein the individual encryption transition state indicates respective ones of a plurality of different schemes currently applied to the plurality of data blocks, and wherein the individual encryption state indicates at least one of the plurality of data blocks currently applies the new encryption scheme when the query is received; perform in-place encryption for the one or more data blocks so that no database data of the one or more data blocks is moved, wherein to perform the in-place encryption, the database system is configured to: read the one or more data blocks in the storage system to perform the query; return a response to the query based on the one or more data blocks use data read from the one or more data blocks to perform the query to encrypt the data read from the one or more data blocks with the new encryption scheme; store, in the one or more data blocks, the data encrypted with the new encryption scheme; and update the individual encryption transition state of the one or more data blocks to indicate that different one of the plurality of schemes, is currently applied.