Configure TDE for an ApsaraDB RDS for SQL Server instance

Precautions

• TDE cannot be disabled after it is enabled for an RDS instance. TDE can be disabled after it is enabled for a database.
• If you use Key Management Service (KMS) to generate a key after you enable TDE on an RDS instance, you must disable TDE for the RDS instance before you can restore the data of the RDS instance to a self-managed database. For more information, see the "Disable TDE" section of this topic.
  Note After you disable TDE, some transaction logs are still encrypted. The backup files that are downloaded cannot be used to restore the data of the RDS instance. You can wait until three log backups and one full backup are complete on the RDS instance. Then, you can download the most recent full backup file that is generated. This full backup file contains the decrypted data of the RDS instance. For more information, see Database Encryption in SQL Server 2008 Enterprise Edition. For more information about how to configure a backup policy, see Back up an ApsaraDB RDS for SQL Server instance.
• After you enable TDE for an RDS instance, the CPU utilization of the RDS instance significantly increases.

Enable TDE

1. Visit the RDS instance list, select a region above, and click the target instance ID.
2. In the left-side navigation pane, click Data Security.
3. On the TDE tab, turn on the switch next to TDE Status.
   Note You can enable TDE only when the RDS instance meets the requirements that are described in the "Prerequisites" section of this topic.
4. Select a key.
   

   • If you select the Use a key automatically generated by Alibaba Cloud option, perform the following operations:
     In the TDE Settings dialog box, select databases from the Unselected Databases section, click the icon to move the selected databases to the Selected Databases section, and then click OK.
   • If you select the Encrypt with own SQL Server key option, perform the following operations:
     1. Upload the certificate file and the private key file to your OSS bucket. For more information, see Upload objects.
     2. Click Next and configure the parameters related to the key.

        Parameter	Description
        OSS Bucket	The OSS bucket in which the certificate file and the private key file are stored.
        Certificate	The certificate file that you uploaded to the OSS bucket.
        Private key	The private key file that you uploaded to the OSS bucket.
        Password	The password of your own SQL Server key.

     3. Click Next to go to the Authorization Database page.
        Select databases from the Unselected Databases section, click the icon to move the selected databases to the Selected Databases section, and then click OK.

Disable TDE

After TDE is enabled for an RDS instance, TDE cannot be disabled. To disable TDE for a database, you can remove the database from the Selected Databases section.

1. Visit the RDS instance list, select a region above, and click the target instance ID.
2. In the left-side navigation pane, click Data Security.
3. Click the TDE tab in the upper section of the page. Then, click TDE Settings on the TDE tab.
4. In the TDE Settings dialog box, select databases from the Selected Databases section, click the icon to move the selected databases to the Unselected Databases section, and then click OK.