Data encryption

SSL (encryption in transit)

Secure Sockets Layer (SSL) encrypts the connection between your application and an RDS instance to prevent man-in-the-middle attacks. ApsaraDB RDS provides a server SSL certificate for each instance, which your application can use to verify that the endpoint it connects to is the intended RDS instance.

After you enable SSL and configure server authentication in your application, all traffic on that connection is encrypted. ApsaraDB RDS also lets you update the server SSL certificate to keep it current and valid.

SSL consumes additional CPU resources, which reduces throughput and increases response latency. The actual impact depends on the number of concurrent connections and data transmission frequency.

For configuration steps, see Configure SSL encryption for an ApsaraDB RDS instance.

TDE (encryption at rest)

Transparent Data Encryption (TDE) encrypts data before it is written to storage — including disks, SSDs, Peripheral Component Interconnect Express (PCIe) cards, and Object Storage Service (OSS). All data files and backup files of the encrypted database or table are stored in ciphertext.

TDE is independently developed by Alibaba Cloud for MySQL and PostgreSQL. For SQL Server, TDE is based on SQL Server Enterprise Edition.

TDE uses the Advanced Encryption Standard (AES) algorithm. The encryption key is stored in Key Management Service (KMS). The RDS instance retrieves the key once at startup or during migration. To rotate the key, use the KMS console.

For configuration steps, see Set TDE for an RDS MySQL instance and TDE test report.

Cloud disk encryption (encryption at rest)

Cloud disk encryption protects all data on a cloud disk at the block storage level. It is available free of charge for RDS instances that use cloud disks.

Cloud disk encryption operates at the storage layer and is transparent to the database engine. No application changes are required, and enabling the feature does not interrupt your workloads.

For configuration steps, see Configure the disk encryption feature for an ApsaraDB RDS for MySQL instance.

Always-confidential (encryption in use)

The always-confidential feature, available on ApsaraDB RDS for PostgreSQL, encrypts sensitive columns so that data remains in ciphertext during transmission, computation, and storage.

The capabilities depend on your instance type:

• Intel Software Guard Extensions (SGX)-based security-enhanced instances: Data is protected by the trusted execution environment (TEE) provided by Intel SGX. All database operations, including comparisons and computations, are performed on ciphertext within the TEE.

• Other instance types: Data is protected using cryptography techniques. Only a subset of database operations is supported on ciphertext data.

For supported instance types, see Instance types for primary ApsaraDB RDS for PostgreSQL instances.

Choose an encryption method

Use this table to select the right method for your requirements: