Disk encryption

Prerequisites

• Storage type: ESSD Cloud Disk.

• Instance family: dedicated.

• Architecture: replica set or sharded cluster.

Billing

Disk encryption is free. KMS charges apply per KMS 1.0 billing.

Considerations

• Disk encryption can only be enabled at instance creation and cannot be disabled later.

• Snapshots and instances derived from an encrypted instance are automatically encrypted.

• If your Key Management Service (KMS) account has overdue payments, disks cannot be decrypted and the instance becomes unavailable. Keep your KMS key valid to avoid service disruptions.

• Disabling or deleting a KMS key disrupts operations such as configuration changes, snapshot creation and restoration, and secondary node rebuilds.

• Only default KMS keys are supported.

• Restoring an encrypted instance from the recycle bin requires its associated KMS key to be available.

• While the KMS key is available, you can restore the instance by using existing backups after you delete the instance. If the KMS key is disabled, deleted, or overdue, the instance cannot generate valid backups, and data cannot be restored after the instance is deleted. Make sure that the KMS key is always available and confirm that available backups exist before you delete the instance.

Enable disk encryption

1. Go to the ApsaraDB for MongoDB purchase page.

2. Configure the following encryption parameters on the purchase page.

   Parameter	Description
   StorageType	Select ESSD Cloud Disk. Only ESSD supports disk encryption.
   Encryption Type	Select Disk Encryption.
   Service-linked Role	A service-linked role is required for disk encryption. If already created, the status shows Created. Otherwise, click Create Service-Linked Role.
   Encryption Key	Select a KMS key for disk encryption. If no KMS key exists in the current region, create a key in the KMS console. Note Only default KMS keys are supported.

   For other parameters, see Create a replica set instance or Create a sharded cluster instance.