Log encryption

Limitations

When you configure data encryption, you cannot modify the encryption mechanism after you select it for the first time. You also cannot modify the encryption algorithm or encryption type. You can only use the enable parameter to enable or disable the encryption feature. In addition, you must include the complete encrypt_conf parameter each time you update the Logstore.

For example, if you select the service-managed key mechanism, you cannot switch to the Bring Your Own Key (BYOK) mechanism.

Encrypt with service-managed keys

When you call the CreateLogstore API to create a Logstore or the UpdateLogstore API to modify a Logstore, add the encrypt_conf parameter to configure encryption.

The following table describes the encrypt_conf parameter. For this method, do not specify the user_cmk_info field.

Encrypt with BYOK

Prerequisites

You have activated Key Management Service (KMS). For more information, see Purchase a dedicated KMS instance.

Step 1: Grant BYOK permissions

Before you use the BYOK method, you must grant the required Resource Access Management (RAM) permissions.

1. Log on to the RAM console.

2. Create a RAM role for a trusted Alibaba Cloud service with the following configurations:

   For Role Type, select common service role. For Role Name, enter KMS-TEST. For Select Trusted Service, select Simple Log Service.

3. Grant the AliyunKMSReadOnlyAccess and AliyunKMSCryptoUserAccess permissions to the RAM role. For more information, see Grant permissions to a RAM role.

4. Grant the ram:PassRole permission. You can skip this step if you use your Alibaba Cloud account to configure BYOK encryption. If you use a RAM user, you must create a custom policy and then grant permissions to the RAM user.

   The Resource value in the following policy must be replaced with the ARN of the RAM role that was created in Step 2. For more information about how to view the ARN of a RAM role, see How do I view the ARN of a RAM role?.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "ram:PassRole",
               "Resource": "acs:ram::<account-id>:role/<role-name>"  
           }
       ]
   }

Step 2: Configure data encryption

After you enable the log analysis feature in the Cloud Firewall console, Cloud Firewall automatically creates a dedicated Project and a dedicated Logstore. You must call the UpdateLogstore API to encrypt data by adding the encrypt_conf parameter to the Logstore configuration.

Before calling the UpdateLogstore API, you must first call the GetLogstore API to retrieve the current Logstore configuration. After you modify the configuration, pass the complete, updated configuration to the UpdateLogstore API.

The following table describes the encrypt_conf parameter. In this scenario, you must specify the user_cmk_info field.

EncryptUserCmkConf data structure

encrypt_conf = {
    "enable" : true,                 # Specifies whether to enable encryption.
    "encrypt_type" : "default",      # The encryption algorithm. Supported values: default, m4, sm4_ecb, sm4_cbc, sm4_gcm, aes_ecb, aes_cbc, aes_cfb, aes_ofb, and aes_gcm.
    "user_cmk_info" :                # Optional. If you specify this parameter, BYOK is used. Otherwise, a service key is used.
    {
          "cmk_key_id" : "",         # The ID of the CMK for BYOK. Example: f5136b95-2420-ab31-xxxxxxxxx.
          "arn" :  "",               # The ARN of the RAM role that you created in Step 1.
          "region_id" : ""           # The region ID where the CMK is located.
    }
}

Related documents

The following API operations are related to Simple Log Service:

• CreateLogstore

• UpdateLogstore

• GetLogstore