How to enable cloud disk encryption-AnalyticDB(AnalyticDB)-阿里云帮助中心

You can enable disk encryption when you create an AnalyticDB for MySQL cluster. Once enabled, this feature encrypts the entire data disk based on block storage. This ensures that even if a data backup is compromised, it cannot be decrypted.

What is encrypted

After enabling disk encryption, AnalyticDB for MySQL creates an encrypted cloud disk, mounts it to the ECS instance, and encrypts the following data on the cloud disk:

The hot data of clusters in Enterprise Edition, Basic Edition, Data Lakehouse Edition, and Data Warehouse Edition in elastic mode.

Important
Cold data is not stored on cloud disks and therefore cannot be encrypted.
All data of clusters in Data Warehouse Edition in reserved mode.
Data in transit between the cloud disk and the cluster.
All snapshots created from an encrypted cloud disk.

Considerations

You can enable disk encryption only when you create an AnalyticDB for MySQL cluster. You cannot enable this feature for an existing cluster.
You cannot disable disk encryption after it is enabled.
After enabling disk encryption for a cluster in reserved mode, snapshots created from the cluster and any new clusters created from these snapshots are also automatically encrypted. To check whether disk encryption is enabled for a cluster, see Check whether disk encryption is enabled.
Enabling disk encryption affects the read and write performance of the cluster. It typically reduces performance by about 10%.
Disk encryption is transparent to your applications, so no changes are required.

Billing

Disk encryption uses Key Management Service (KMS). Charges apply for key management and API calls. For more information about KMS pricing, see KMS 1.0 pricing.

Procedure

You can enable disk encryption only when you create an AnalyticDB for MySQL cluster. To encrypt an existing cluster's data, create a new cluster with disk encryption enabled and then migrate the data to it.

On the cluster buy page, select Disk Encryption.
If this is the first time you are enabling disk encryption, click Create Service-linked Role.
Note
- Click Create Service-linked Role only if this is the first time you are enabling disk encryption. If the page displays a status of Created, a service-linked role already exists and you can skip this step.
- Disk encryption requires a service-linked role (SLR) to access Key Management Service (KMS). For more information, see Service-linked role for AnalyticDB for MySQL disk encryption.
From the Key drop-down list, select the key that you want to use.
Note
- If no keys are available in the drop-down list, you must create a key first. For instructions, see Create a key.
- The disk encryption feature of AnalyticDB for MySQL supports only manually created service keys. When you create a key, you must set the Rotation Period to Disabled.
- After access to Key Management Service (KMS) is authorized, ActionTrail records your operations on KMS resources. For more information, see Use ActionTrail to query the operation events of KMS.
After you configure the settings for disk encryption, continue with the remaining steps to create an AnalyticDB for MySQL cluster.

Check whether disk encryption is enabled

Log on to the AnalyticDB for MySQL console. In the upper-left corner of the console, select a region. In the left-side navigation pane, click Clusters. Find the cluster that you want to manage and click the cluster ID.
In the left-side navigation pane, click Cluster Management > Cluster Information.
In the Configuration Information section, find KMS Key ID for Disk Encryption.

If KMS Key ID for Disk Encryption is not displayed in the Configuration Information area, this means that disk encryption is not enabled for the cluster.