Authorize ApsaraDB RDS to access KMS

Background information

Cloud disk encryption provides robust protection for your data at rest without requiring changes to your services or applications. For more information about cloud disk encryption, see the following topics:

• Cloud disk encryption for ApsaraDB RDS for MySQL

• Cloud disk encryption for ApsaraDB RDS for PostgreSQL

• Cloud disk encryption for ApsaraDB RDS for SQL Server

• Cloud disk encryption for ApsaraDB RDS for MariaDB

Create AliyunRDSInstanceEncryptionRolePolicy

1. Go to the Policies page in the RAM console.

2. Click Create Policy.

   Note

   A policy is a set of permissions defined by a specific syntax. It precisely describes the authorized resources, actions, and conditions.

3. Click the Edit Script tab and paste the following policy document into the editor.

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "kms:List*",
                   "kms:DescribeKey",
                   "kms:TagResource",
                   "kms:UntagResource"
               ],
               "Resource": [
                   "acs:kms:*:*:*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "kms:Encrypt",
                   "kms:Decrypt",
                   "kms:GenerateDataKey"
               ],
               "Resource": [
                   "acs:kms:*:*:*"
               ],
               "Effect": "Allow",
               "Condition": {
                   "StringEqualsIgnoreCase": {
                       "kms:tag/acs:rds:instance-encryption": "true"
                   }
               }
           }
       ]
   }

4. Click OK. In the dialog box that appears, configure the following parameters and click OK.

   Parameter	Description
   Policy Name	Enter AliyunRDSInstanceEncryptionRolePolicy.
   Description	Enter a description. For example: Allows ApsaraDB RDS to access KMS.
   Tags	(Optional) Add one or more tags to the policy.

Create and authorize AliyunRDSInstanceEncryptionDefaultRole

After you create the policy, you must attach it to a RAM role. This allows ApsaraDB RDS to assume the role to access KMS resources.

1. Go to the Roles page in the RAM console.

2. Click Create Role.

3. Select AnyTunnel, and in the Trusted Service drop-down list, select ApsaraDB RDS that ends with rds.aliyuncs.com and click OK.

4. In the Create Role dialog box, enter AliyunRDSInstanceEncryptionDefaultRole for Role Name and click OK.

5. On the confirmation page, click Grant Permission.

   Note

   If you have closed the Role created successfully page, you can also search for AliyunRDSInstanceEncryptionDefaultRole on the RAM Role Management page, and then click Grant Permission.

6. On the Grant Permission page, search for and click the AliyunRDSInstanceEncryptionRolePolicy policy. The policy appears in the Selected box on the right.

7. Click OK.

(Optional) View the role ARN

The Alibaba Cloud Resource Name (ARN) is a unique identifier for a RAM role. You must provide this ARN when you enable cloud disk encryption by using an API call, such as CreateDBInstance, to specify the role that has permission to access KMS.

1. Go to the Roles page in the RAM console.

2. Find the target role and click its name.

3. On the role details page, find the ARN in the upper-right corner and copy it.