Risk governance
Answers to common questions about data masking and column encryption in Data Security Center (DSC).
Does static data masking modify raw data?
No. Static data masking reads data, masks data, and writes the masked output to the destination you specify. The source data is never modified.
What data sources and formats does DSC support for data masking?
| Data source / format | Supported | Notes |
|---|---|---|
| Relational databases (e.g., ApsaraDB RDS for MySQL) | Yes | — |
| Object Storage Service (OSS) as destination | Yes | CSV and XSL formats only |
| Image masking | No | — |
| ApsaraDB for Redis | No | Only security baseline check is available |
What are the prerequisites for column encryption on ApsaraDB RDS for MySQL or PolarDB for MySQL?
Before you configure column encryption rules, make sure:
ApsaraDB RDS for MySQL: The instance runs MySQL 5.7 or MySQL 8.0 with minor engine version 20240731 or later.
PolarDB for MySQL: The instance runs MySQL 5.7 or MySQL 8.0 with database proxy version 2.8.36 or later.
Enough columns are purchased for column encryption. To buy or adjust columns, see Purchase DSC. To change your subscription specifications, see Specification change of subscription DSC.
DSC is authorized to access the ApsaraDB RDS and PolarDB instances. See Authorize DSC to access databases.
Sensitive data column identification has been run on the instances. See Identify sensitive data by using identification tasks.
For more information, see Column encryption.
Why are my authorized ApsaraDB RDS and PolarDB instances not showing on the Column Encryption page?
Only MySQL instances appear on the Data Governance > Column Encryption page. If your authorized instance runs a different database engine, it is not listed there.
How do I fix an encryption check failure?
If Failed appears in the Encryption Check column, use the following table to identify the cause and resolve it.
| Instance type | Failure reason | Resolution |
|---|---|---|
| ApsaraDB RDS for MySQL | Does not run MySQL 5.7 or MySQL 8.0 | Go to Instances and upgrade the database version. See Upgrade the major engine version. |
| ApsaraDB RDS for MySQL | Minor engine version is earlier than 20240731 | Click Update Minor Engine Version, set Latest Version and Update Time, and click OK. See Update the minor engine version. Column encryption is available only after the update completes. |
| ApsaraDB RDS for MySQL | Instance is a read-only instance | Enable column encryption on the primary RDS instance instead. During creation, ApsaraDB RDS replicates data from the secondary RDS instance to the read-only instance. After creation, the read-only instance has the same data as the primary instance, and ApsaraDB RDS immediately synchronizes any updates from the primary instance to all attached read-only instances. |
| PolarDB for MySQL | Does not run MySQL 5.7 or MySQL 8.0 | Go to the PolarDB console, find the instance, and upgrade the database engine version. See Major version upgrade. |
| PolarDB for MySQL | Database proxy version is not supported | Update the database proxy version. See Minor version update. Column encryption is available only after the update completes. |