Data encryption at rest

Encrypt all data stored at rest using Alibaba Cloud's built-in service encryption and Key Management Service (KMS) to protect against unauthorized access and meet storage requirements for sensitive data.

Unencrypted data at rest is vulnerable to unauthorized access if storage infrastructure is compromised. Alibaba Cloud services — including ECS disks, OSS, ApsaraDB, and NAS — support storage encryption natively. All encryption uses 256-bit Advanced Encryption Standard (AES-256) keys managed through Key Management Service (KMS) for centralized key management, meeting the storage requirements for sensitive data.

Key management options

Choose a key management approach based on your security requirements:

• Platform-managed default key: Alibaba Cloud generates and manages the key at no cost. You can use the free default key provided by Alibaba Cloud for server-side encryption.

• Bring Your Own Key (BYOK): Import your own key material into KMS for server-side encryption.

Implementation

1. Review the list of Alibaba Cloud services that support server-side encryption and follow the per-service instructions to enable it.

2. To use the free platform-managed default key, see What is a default key?

3. To use a BYOK key for server-side encryption, see Import symmetric key material.