DocsICP FilingConsole
官方文档
首页

Configure Transparent Data Encryption

更新时间：
复制 MD 格式
产品详情
我的收藏

For security compliance or to encrypt data at rest, use the Transparent Data Encryption (TDE) feature. TDE encrypts and decrypts data files in real time. By encrypting data at rest at the database layer, TDE prevents attackers from reading sensitive information directly from storage and improves data security.

Background

For more information about the principles of TDE, see TDE encryption and decryption.

Prerequisites

  • Your ApsaraDB RDS for PostgreSQL instance must meet the following requirements:

    • The major engine version is PostgreSQL 10 or later.

    • The storage type is cloud disk.

    • The minor engine version of the instance is 20221030 or later. To view and update the minor engine version, see Update the minor engine version.

    • If the instance has read-only instances, each read-only instance must also meet the preceding requirements.

  • You have used an Alibaba Cloud account to authorize ApsaraDB RDS to access Key Management Service (KMS). For more information, see Authorize ApsaraDB RDS to access KMS.

  • Key Management Service (KMS) is enabled. If KMS is not enabled, you can follow the on-screen instructions to enable it when you enable TDE.

Precautions

  • Make sure that the minor engine versions of the primary instance and its read-only instances are 20221030 or later. Otherwise, enabling TDE will fail.

  • Enabling TDE may affect database performance in I/O-intensive (I/O-bound) scenarios.

  • TDE-enabled instances do not support self-managed standby instances created with physical streaming replication.

  • You cannot disable TDE after you enable it.

  • Make sure that Key Management Service (KMS) is available. Otherwise, the cloud disks cannot be decrypted, and the entire instance will become unavailable.

  • If you use an existing customer master key (CMK), note the following:

    • If you disable or delete a CMK in KMS, your ApsaraDB RDS instance cannot work as expected. The affected operations include creating a snapshot, restoring from a snapshot, and rebuilding a standby instance.

    • If you revoke the authorization and then restart the ApsaraDB RDS instance, the instance becomes unavailable.

    • You must use an Alibaba Cloud account or an account with the AliyunSTSAssumeRoleAccess permissions.

    Note

    For more information about key operations, see Key Management Service.

Enable TDE

  1. Go to the ApsaraDB RDS Instances page, select the region at the top of the page, and then click the ID of the target instance.

  2. In the left-side navigation pane, click Data Security.

  3. On the TDE tab, turn on the switch next to the Disabled status.

  4. Select a key type and click OK to enable TDE.

    • Use an Automatically Generated Key: The key encryption key (KEK) used in this method is a service key from KMS.

    • Use Existing Custom Key : The KEK used in this method is a customer master key (CMK) that you import to KMS. If you do not have a CMK, click create now. to create a key and import your key material on the KMS console. For more information, see Create a CMK.

Replace a key

  1. Go to the ApsaraDB RDS Instances page, select the region at the top of the page, and then click the ID of the target instance.

  2. In the left-side navigation pane, click Data Security.

  3. On the TDE tab, click Replace Key to the right of TDE Status.

  4. Select Use an Automatically Generated Key or Use Existing Custom Key , select a key, and then click OK.

Encrypt or decrypt tables and indexes

Enabling TDE at the instance level does not automatically encrypt data. You must also specify which tables and indexes to encrypt or decrypt.

Note

Define an appropriate encryption scope to minimize performance overhead.

Encrypt

  • Global settings

    On the ApsaraDB RDS console, you can set the rds_default_table_encryption parameter to on. After this parameter is enabled, new tables (CREATE TABLE) and indexes (CREATE INDEX) are encrypted by default.

    Note

    • This parameter applies only to ApsaraDB RDS for PostgreSQL 13, 14, and 15 instances. To modify parameters, see Modify the parameters of an ApsaraDB RDS for PostgreSQL instance.

    • If you cannot find this parameter, update the minor engine version to the latest version and then try again. For more information, see Update the minor engine version.

    • Changing the rds_default_table_encryption parameter from on to off affects only subsequently created tables and indexes. Existing encrypted tables and indexes remain encrypted.

  • Encrypt specific tables and indexes

    • Encrypt a table.

      -- Create an encrypted table.
CREATE TABLE <tablename> WITH (encryption=on);

-- Encrypt an existing table.
ALTER TABLE <tablename> SET (encryption=on);

    • Encrypt an index.

      -- Create an encrypted index.
CREATE INDEX <indexname> ... WITH (encryption=on);

-- Encrypt an existing index.
ALTER INDEX <indexname> SET (encryption=on);
      Note

      TDE supports encryption for the following index types: btree, hash, spgist, gin, gist, and brin.

Decrypt

Note

The following ALTER statements trigger a table or index rewrite, which is similar to VACUUM FULL. Do not run these statements during peak business hours.

  • Decrypt an encrypted table.

    ALTER TABLE <tablename> SET (encryption=off);

  • Decrypt an encrypted index.

    ALTER INDEX <indexname> SET(encryption=off);

Encryption status

SELECT relname, reloptions FROM pg_class WHERE relname IN ('<tablename>', '<indexname>');

FAQ

  • Can I still use common database tools such as pgAdmin after enabling TDE?

    Yes.

  • Can I still migrate data to other ApsaraDB RDS instances after enabling TDE?

    Yes.

  • Why does my data appear in plaintext when queried, even after I enable TDE?

    Data appears in plaintext because the database decrypts it into memory when you run a query. TDE protects data at rest, preventing data leaks from storage media or compromised backup files, which remain encrypted.

Related documents

Previous：Use the TDE featureNext：Column encryption