ApsaraDB RDS:Use the cloud disk encryption feature

Prerequisites

• The cloud disk encryption feature is enabled. The cloud disk encryption feature can be enabled for your RDS instance only when you create the RDS instance. For more information, see Create an ApsaraDB RDS for SQL Server instance.

• Your RDS instance meets the following requirements:

  • The RDS instance uses the standard SSD, enhanced SSD (ESSD), or general ESSD storage type.

  • The RDS instance belongs to the general-purpose or dedicated instance family. The shared instance family is not supported.

    Note

    Serverless RDS instances do not support the cloud disk encryption feature.

Billing rules

The cloud disk encryption feature is provided free of charge. You do not need to pay additional fees for the read and write operations that you perform on the encrypted disks.

Usage notes

• Cross-region backups are not supported for RDS instances for which the cloud disk encryption feature is enabled. For more information, see Enable the cross-region backup feature for an ApsaraDB RDS for SQL Server instance.

• If your Key Management Service (KMS) is overdue, the standard SSDs or ESSDs of your RDS instance become unavailable. Make sure that your KMS is normal. For more information, see What is KMS?

• If you disable or delete the key of an RDS instance in KMS, your RDS instance cannot run as expected. In this case, your RDS instance is locked and cannot be accessed. In addition, you cannot perform all O&M operations on the RDS instance. For example, you cannot perform backups, change instance specifications, clone or restart the RDS instance, perform a high-availability switchover, or modify instance parameters. To prevent these issues, we recommend that you use the default service customer master key (CMK), which is a service key managed by ApsaraDB RDS.

• If you create an RDS instance that uses the general-purpose instance type and cloud disks, you can select only Default Service CMK to enable the cloud disk encryption feature for the RDS instance. If you create an RDS instance that uses the dedicated instance type and cloud disks, you can select Default Service CMK or a CMK to enable the cloud disk encryption feature for the RDS instance. For more information, see [Product changes/Feature changes] The cloud disk encryption feature of ApsaraDB RDS is adjusted from January 15, 2024.

Enable the cloud disk encryption feature for an RDS instance

When you create an RDS instance, select the standard SSD, ESSD, or general ESSD storage type, select Disk Encryption, and then specify a key. For more information, see Create an ApsaraDB RDS for SQL Server instance.

View the status of the cloud disk encryption feature and key details

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. On the Basic Information page of the RDS instance, view the key of the RDS instance that uses cloud disks.

   Note

   • If the key is not displayed on the Basic Information page, the cloud disk encryption feature is disabled for the RDS instance during instance creation.

   • The feature can be enabled for your RDS instance only when you create the RDS instance. For more information, see Create an ApsaraDB RDS for SQL Server instance.

   • In the KMS console, you can view all keys within the current account. In the left-side navigation page of the KMS console, click Keys. On the page that appears, click the Default Key tab and then find the key that you want to view. If the value in the Key Usage column is Service Key, the key is a service key managed by an Alibaba Cloud service. The alias of the service key managed by ApsaraDB RDS is alias/acs/rds. If you do not find the key, no service key has been created in the region. When you enable the disk encryption feature and select Default Service CMK during the instance creation in the ApsaraDB RDS console, the system automatically creates a service key.

   • The key specification of the default service CMK is Aliyun_AES_256. The key rotation feature is disabled by default. If you want to enable the key rotation feature, purchase the key rotation feature in the KMS console. For more information, see Configure key rotation.

Related operations

• You call the CreateDBInstance operation to enable the cloud disk feature when you create an instance. For more information, see CreateDBInstance.

• You can call the DescribeDBInstanceEncryptionKey operation to query whether the cloud disk encryption feature is enabled for an instance and the key details. For more information, see DescribeDBInstanceEncryptionKey.