Column encryption

After you grant the required permissions, your DSC instance can access resources from cloud services such as OSS, RDS, and MaxCompute.

1. Log on to the Data Security Center console.

2. In the RAM authorization dialog box, click Authorize immediately.

   Note

   If the RAM authorization dialog box does not appear, DSC is already authorized to access your cloud resources.

Before using DSC to scan for sensitive data or audit database activities in cloud products like RDS and PolarDB, you must authorize the asset instances.

1. Log on to the Data Security Center console. In the left-side navigation pane, choose Asset Center.

2. On the Authorization Management tab, click Asset Authorization Management.

3. In the product navigation pane on the left side of the Asset Authorization Management page, select the data type that you want to authorize and click Asset synchronization.

   Note

   After you purchase a DSC instance, the console immediately runs a task to synchronize your cloud assets. You do not need to perform asset synchronization in this case. For newly added data assets, DSC scans and automatically synchronizes them to the unauthorized list of the corresponding assets every day at midnight. Existing users must manually perform Asset synchronization on the Asset Authorization Management page, which is on the Asset Center > Authorization Management tab.

4. In the Actions column of the target asset, click Authorization.

   To authorize multiple assets at once, select the target assets and click Batch Authorize.

1. Log on to the Data Security Center console. In the left-side navigation pane, choose Asset Center.

2. On the Authorization Management tab, click Account Logon in the Actions column of the target asset instance.

3. In the Account Logon panel, click Add Credential in the Actions column of the target database.

4. In the Add Credential dialog box, select a credential. Leave Scan assets and identify sensitive data now. selected or clear it, and then click OK.

   If you have not created a credential, click the Create Credential tab in the Add Credential dialog box. Configure the Credential Name, Username, Password, and Credential Type for the database logon account, and then click OK.

   Important

   • If you select Scan assets and identify sensitive data now., DSC automatically creates and runs a default identification task. The identification task reads data from the database and consumes read performance. We recommend that you perform this operation during off-peak hours.

   • If you clear Scan assets and identify sensitive data now., you can manually run the default task. In the left-side navigation pane, choose Classification and Grading > Tasks. On the Identification Tasks tab, find the task in the Default Tasks list and click Rescan.

5. Click the icon to the left of the database instance to view its connection and feature status.

   The connection status of the database is displayed as Connected.

If the version of the authorized ApsaraDB RDS for PostgreSQL database is not PostgreSQL 16, the minor engine version is earlier than 20250228, or it is a read-only instance, the Encryption Check column displays Failed.

• Unsupported database version

  If you need to configure column encryption for the target RDS database, go to the RDS instance list, find the target instance, and upgrade the major engine version. For more information, see Upgrade the major engine version.

• Unsupported minor engine version

  In the asset list on the Asset Management page, if the Encryption Check column for the target RDS instance displays Failed, an update the minor engine version link appears next to it.

  If you need to configure column encryption for the target RDS database, click Update Minor Engine Version, select an Upgrade Version and an Update Time, and then click OK. The RDS database supports column encryption only after the minor engine version is upgraded. For detailed instructions, see Update the minor engine version.

  Upgrading the minor engine version restarts the instance and causes a transient disconnection of about 30 seconds. We recommend that you perform this operation during off-peak hours and ensure that your application has an automatic reconnection mechanism.

• Read-only instance

  Data in a read-only instance is copied from a secondary instance and remains consistent with the primary instance. Updates to the primary instance are automatically synchronized to all read-only instances. Therefore, you must configure column encryption on the primary instance.

After you upgrade the version, you must perform asset synchronization in the DSC console to update the database information.

1. In the left-side navigation pane, choose Asset Center. Then, on the Authorizations tab, click Asset Authorization Management.

2. In the product navigation pane on the left side of the Asset Authorization Management page, click the target instance type.

3. On the Asset Authorization Management page, click Asset synchronization.