Data security
Tablestore provides server-side encryption and client-side encryption to protect your cloud data from security risks. Tablestore supports zone-redundant storage (ZRS) to ensure high availability and disaster recovery. You can back up critical data by using Cloud Backup to prevent accidental deletion or malicious tampering. Additionally, Tablestore uses the V4 signature algorithm to protect your access key pair and reduce the risk of exposure.
Data encryption
Encryption at rest
Tablestore supports encryption at rest to prevent attackers from bypassing the database. For more information, see Data encryption.
By default, encryption at rest is disabled. To enable this feature, in the Create Table dialog box, turn on the Encryption switch and select an encryption type.
Once enabled, encryption at rest cannot be disabled. Proceed with caution.
Tablestore provides two encryption methods: encryption based on a Key Management Service (KMS) key and encryption based on Bring Your Own Key (BYOK). For both methods, you must obtain the encryption keys from KMS.
Encryption method | Usage | Description |
Encryption using a KMS service key |
| Tablestore uses a default service-managed key from KMS to encrypt your data and automatically decrypts it when you access it. When you use this method for the first time, Tablestore creates a service-managed key in KMS. You can use this feature without purchasing a separate KMS instance. |
Encryption using a custom key (Bring Your Own Key) |
| After you create a key with your own key material in the KMS console, Tablestore uses your custom key to encrypt data. This gives you full control over your encryption keys. |
Encryption in transit
Tablestore supports Transport Layer Security (TLS) to encrypt data in transit. All communication between the Tablestore client and the server is encrypted by using TLS. For more information, see Restrict the TLS version for instance access.
Tablestore allows you to restrict the TLS versions used for access by using custom RAM policies, control policies, and other methods. Later versions of TLS use more secure encryption algorithms. We recommend that you use TLS 1.2 or later. For more information, see Custom RAM policies, Control Policy examples, and Instance Policy examples.
Disaster recovery
Tablestore provides two data redundancy types: locally redundant storage (LRS) and zone-redundant storage (ZRS). For high availability, select a region that supports ZRS. For more information, see Zone-redundant storage.
LRS
LRS uses a single-zone redundancy model to replicate your data across devices within the same zone. LRS is designed to ensure data durability and service availability if a hardware device in the zone fails.
LRS stores data within a single Availability Zone. If that zone becomes unavailable or all hardware within it fails simultaneously, the data becomes inaccessible.
ZRS
ZRS uses a multi-zone redundancy model to replicate your data across zones within the same region. If a zone becomes unavailable, ZRS ensures that your data remains accessible.
ZRS provides data center-level disaster recovery. If a zone within a region fails, Tablestore maintains strong consistency. The failover process is transparent to users, with no service interruption or data loss. This achieves a Recovery Time Objective (RTO) of 0 and a Recovery Point Objective (RPO) of 0, meeting the stringent requirements of mission-critical systems.
Data backup and recovery
Tablestore allows you to back up and restore data by using Cloud Backup. Data backups can be used for disaster recovery, restoring data after accidental deletion or malicious tampering, data versioning, legal and compliance requirements, and data migration. For more information, see Backup and recovery.
Cloud Backup is Alibaba Cloud’s unified disaster recovery platform. It is a secure and reliable cloud data management service. It provides backup, disaster recovery protection, and policy-based archiving for ECS instances, ECS databases, file systems, NAS, OSS, Tablestore, and files, databases, virtual machines, and large-scale NAS deployed in on-premises datacenters. For more information, see What is Cloud Backup.
To prevent important data from becoming unavailable due to issues such as accidental deletion or malicious tampering, you can use the Tablestore data backup feature to back up wide column data in an instance and restore it in a timely manner if the data is lost or damaged. For more information, see Data Backup, Data Recovery, and Backup Anomaly Alarms.
Access key pair security
The Tablestore client supports the V4 signature algorithm to generate a derived key from an access key pair. The client uses the derived key to initiate requests. When the Tablestore server receives a request, it uses the derived key to authenticate the user. This avoids transmitting the access key pair during authentication and reduces the risk of key exposure. For more information, see Access key pair security.