DocsICP FilingConsole
官方文档
首页

Cloud disk encryption

更新时间：
复制 MD 格式
产品详情
我的收藏

ApsaraDB RDS for PostgreSQL offers free cloud disk encryption to protect data at rest.

Background information

This feature is free. You are not charged for read or write operations on encrypted disks.

Prerequisites

  • Your ApsaraDB RDS for PostgreSQL instance meets the following requirements:

    • Edition: RDS Basic Edition, RDS High-availability Edition, or RDS Cluster Edition

    • storage type: Enterprise SSD (ESSD) or Premium ESSD

    Note

    Serverless instances are not supported.

  • Key Management Service (KMS) is activated. For more information, see Purchase and enable a KMS instance.

Usage notes

  • Cloud disk encryption does not affect your business and requires no application modifications.

  • After you enable cloud disk encryption, snapshots created from the instance and any cloud disk-based instances created from those snapshots automatically inherit the encryption attribute.

  • If your Key Management Service (KMS) account has overdue payments, the cloud disks cannot be decrypted, which makes the entire instance unavailable. Ensure your KMS account remains in good standing.

  • If you disable or delete a KMS key, the ApsaraDB RDS instance that uses the key will malfunction and become locked. All O&M operations, such as backing up the instance, changing instance configurations, cloning the instance, restarting the instance, performing a high-availability switchover, and modifying parameters, will fail. To avoid this issue, use the service key managed by ApsaraDB RDS (Default Service CMK).ApsaraDB RDS notifies you by SMS, internal messages, and email when the KMS key of your instance is unavailable. Notifications are sent once per day, up to three times.

  • For general-purpose instances, you can enable cloud disk encryption only by using the service key managed by ApsaraDB RDS (Default Service CMK). Instances with dedicated specifications support both the service key managed by ApsaraDB RDS (Default Service CMK) and customer master keys (CMKs). For more information, see [Product/Function Change] Changes to Creating Cloud Disk Encrypted Instances for ApsaraDB RDS Effective January 15, 2024.

  • On the Data Security > Data Encryption page, enabling, replacing, or disabling cloud disk encryption restarts the instance, which causes a transient disconnection. Make sure that your application has an automatic reconnection mechanism.

Enable cloud disk encryption

Enable during instance creation

When you create an ApsaraDB RDS for PostgreSQL instance that meets the prerequisites, you can select the Disk Encryption checkbox next to Storage Type and then select a Key. By default, the service key managed by ApsaraDB RDS (Default Service CMK) is selected. This option is recommended.

For more information about how to create an ApsaraDB RDS for PostgreSQL instance, see Create an ApsaraDB RDS for PostgreSQL instance.

Enable for existing instances

  1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

  2. In the left-side navigation pane, click Data Security.

  3. On the Data Encryption tab, click Enable Encryption.

  4. In the dialog box that appears, select the desired key and click OK.

    We recommend that you use the Default Service CMK, which is the service key managed by ApsaraDB RDS.

    The instance status changes during encryption. When the status returns to Running, cloud disk encryption is enabled.

Note

  • You can view the key used for cloud disk encryption on the Basic Information page and the Data Security > Data Encryption page of your ApsaraDB RDS for PostgreSQL instance.

  • You can view all keys under your account in the KMS console. On the Keys > Default Key tab, keys managed by Alibaba Cloud services are specified as Service Key in the Key Usage column. The alias of the key managed by ApsaraDB RDS is alias/acs/rds. If you cannot find this key, no service key has been created in the current region. When you enable cloud disk encryption in the ApsaraDB RDS for PostgreSQL console and select the service key (Default Service CMK), the system automatically creates one.

  • The service key managed by ApsaraDB RDS (Default Service CMK) has the Aliyun_AES_256 specification. Key rotation is disabled by default. If you need to enable key rotation, purchase the feature in the KMS console. For more information, see Key rotation.

Replace the encryption key

  1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

  2. In the left-side navigation pane, click Data Security.

  3. On the Data Encryption tab, click Replace Key.

  4. In the dialog box that appears, select a new key and click OK.

Disable cloud disk encryption

  1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

  2. In the left-side navigation pane, click Data Security.

  3. On the Data Encryption tab, click Replace Key.

  4. In the dialog box that appears, select Disable Key and click OK.

Related APIs

You can call the ModifyDBInstanceConfig API operation to enable, replace, or disable cloud disk encryption for a target instance.

Previous：Data encryptionNext：Use the TDE feature