ApsaraDB for MyBase supports disk encryption for instances that use enhanced SSDs (ESSDs). Encryption is performed at the block storage level, covering all data on the disk—including backups. Encrypted backup data cannot be decrypted even if leaked. Disk encryption is free.
Supported configurations
Disk encryption is available only when all of the following conditions are met:
| Requirement | Details |
|---|---|
| Instance type | ApsaraDB MyBase for MySQL or ApsaraDB MyBase for PostgreSQL |
| Storage type | Enhanced SSD (ESSD) |
| Edition | High-availability Edition |
| Region | China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Shenzhen), China (Hong Kong), Singapore (Singapore), Malaysia (Kuala Lumpur), Indonesia (Jakarta), Germany (Frankfurt) |
Disk encryption can only be enabled at instance creation time. It cannot be enabled on an existing instance.
Enable disk encryption
When creating an ApsaraDB MyBase for MySQL or ApsaraDB MyBase for PostgreSQL instance:
-
For the storage type, click Enhanced SSD (Recommended).
-
Select Disk Encryption on the right side of the storage selection area.
-
Select the key that you want to use. To create a key, see Create a CMK.
For complete instance creation steps, see Create an ApsaraDB MyBase for MySQL instance or Create an ApsaraDB MyBase for PostgreSQL instance (purchase unavailable).
Behavior and limitations
| Item | Detail |
|---|---|
| Disabling encryption | Disk encryption cannot be disabled after it is enabled. |
| Snapshot encryption | Snapshots generated from an encrypted instance are automatically encrypted. Instances created from those snapshots are also encrypted. |
| Business impact | Disk encryption does not interrupt running workloads. No application changes are required. |
Billing
Disk encryption is free. Read and write operations on encrypted disks do not incur additional charges.