Data encryption - Cloud Monitor - Alibaba Cloud Documentation Center

CloudMonitor 2.0 stores service and application data in Log Service (SLS). Log Service uses Key Management Service (KMS) to encrypt stored data, providing data-at-rest protection.

Prerequisites

You must activate Key Management Service (KMS). For more information, see Purchase a dedicated KMS instance.

Data encryption mechanisms

Log Service supports the following two encryption mechanisms.

SLS service key

Features:

Simplicity: Log Service handles both encryption and key management. No additional actions are required.
Key isolation: A unique data encryption key is generated for each LogStore.
Durability: Data encryption keys never expire.
Supported encryption algorithms: AES (default) and SM4.

Use cases:

You want to encrypt data quickly without managing keys.
You have no specific key management requirements and prefer a provider-managed solution.
You need long-term validity and stability for encryption keys.

Best for:

Small businesses or individual users who want a secure and simple log encryption solution without the complexity of key management.

Bring your own key (BYOK)

Features:

Control: You have full control over the key lifecycle, including creation, rotation, and deletion.
Flexibility: You can update or replace keys as needed.
Proactive management: You must actively manage your keys, including creating a customer master key (CMK) and granting permissions in the KMS console.

Use cases:

Your organization has strict security or compliance requirements that mandate control over encryption keys.
You need to manage and rotate encryption keys to meet high security standards.
You need the ability to quickly replace or delete a key in case of a key compromise or other security risks.

Best for:

Large enterprises or financial institutions with strict data protection requirements, custom key management policies, and dedicated key management teams.

Important

If you delete or disable your customer master key (CMK), the BYOK key becomes invalid.

As a result, all read and write requests to the LogStore will fail.

Limitations

Once configured, you cannot change a LogStore's encryption mechanism, algorithm, or type. You can only use the enable parameter to enable or disable encryption. When updating the LogStore, you must include the complete encrypt_conf parameter in every request.

For example, if you initially choose encryption with an SLS-managed service key, you cannot later switch to the bring your own key (BYOK) method.

Encryption with an SLS service key

When you call the CreateLogStore or UpdateLogStore API operation, add the encrypt_conf parameter to configure encryption.

The following table describes the structure of the encrypt_conf parameter. For this encryption method, do not specify the user_cmk_info parameter.

Parameter	Type	Description	Example
encrypt_conf	Object	The data structure for the encryption configuration.
enable	Boolean	Specifies whether to enable data encryption. true: Enables encryption. false: Disables encryption.	true
encrypt_type	String	The encryption algorithm type. Supported values: default, sm4, sm4_ecb, sm4_cbc, sm4_gcm, aes_ecb, aes_cbc, aes_cfb, aes_ofb, and aes_gcm. This parameter is required when `enable` is set to `true`.	default
user_cmk_info	EncryptUserCmkConf	Optional. If you specify this parameter, bring your own key (BYOK) is used. Otherwise, the Log Service key is used.	{ "cmk_key_id" : "f5136b95-2420-ab31-xxxxxxxxx", "arn" : "acs:ram::13234:role/logsource", "region_id" : "cn-hangzhou" }

Encryption with bring your own key (BYOK)

Prerequisites

You have activated Key Management Service (KMS). For more information, see Purchase a dedicated KMS instance.

Step 1: Grant BYOK permissions

To use BYOK encryption, you must first grant the required permissions in Resource Access Management (RAM).

Log on to the RAM console.
Create a RAM role for a trusted Alibaba Cloud service and configure it as follows.

For Role Type, select Normal Service Role. Set Role Name to KMS-TEST. For Select Trusted Service, select Log Service.
Grant the RAM role the AliyunKMSReadOnlyAccess and AliyunKMSCryptoUserAccess permissions. For more information, see Manage permissions for a RAM role.
Grant the ram:PassRole permission. You can skip this step if you use your Alibaba Cloud account to configure BYOK encryption. If you use a RAM user, you must create a custom permission policy and then manage the permissions of the RAM user to attach the policy.

The Resource value in the following policy must be replaced with the ARN of the RAM role that you create. Configure the role as follows. For Role Type, select Normal Service Role. For Role Name, enter KMS-TEST. Select Log Service as the trusted service. For information about how to view the role ARN, see RAM Role and STS Token FAQ.
```
{"Version": "1","Statement": [{"Effect": "Allow","Action": "ram:PassRole","Resource": "acs:ram::<account-id>:role/<role-name>"}]}
```

Step 2: Configure data encryption

Important

After configuration, you cannot modify the encryption algorithm or type. You can only use the enable parameter to enable or disable encryption. When updating the LogStore, you must include the complete encrypt_conf parameter in every request.

To enable data encryption for an existing LogStore, call the UpdateLogStore API and include the encrypt_conf parameter.

Before calling UpdateLogStore, retrieve the current LogStore configuration by calling GetLogStore. Modify this configuration and then pass it to the UpdateLogStore call.

The following table describes the structure of the encrypt_conf parameter. For this encryption method, you must specify the user_cmk_info parameter.

Parameter	Type	Description	Example
encrypt_conf	Object	The data structure for the encryption configuration.
enable	Boolean	Specifies whether to enable data encryption. true: Enables encryption. false: Disables encryption.	true
encrypt_type	String	The encryption algorithm type. Supported values: default, sm4, sm4_ecb, sm4_cbc, sm4_gcm, aes_ecb, aes_cbc, aes_cfb, aes_ofb, and aes_gcm. This parameter is required when `enable` is set to `true`.	default
user_cmk_info	EncryptUserCmkConf	Optional. If you specify this parameter, bring your own key (BYOK) is used. Otherwise, the Log Service key is used.	{ "cmk_key_id" : "f5136b95-2420-ab31-xxxxxxxxx", "arn" : "acs:ram::13234:role/logsource", "region_id" : "cn-hangzhou" }

EncryptUserCmkConf data structure

Parameter	Type	Description	Example
user_cmk_info	Object	The data structure for the user encryption configuration.
cmk_key_id	String	The ID of the customer master key (CMK) used for BYOK.	f5136b95-2420-ab31-xxxxxxxxx
arn	String	The ARN of the RAM role created in Step 1: Grant BYOK permissions.	acs:ram::13234:role/logsource
region_id	String	The region ID where the CMK is located.	cn-hangzhou

encrypt_conf = {"enable" : True,                 # Specifies whether to enable encryption.
    "encrypt_type" : "default",      # The encryption algorithm. For supported values, see the parameter description in the table above.
    "user_cmk_info" :                # Optional. If you specify this parameter, SLS uses BYOK. Otherwise, the Log Service service key is used.
    {"cmk_key_id" : ""          # The CMK ID for BYOK. Example: f5136b95-2420-ab31-xxxxxxxxx.
          "arn" :  ""                # The ARN of the RAM role created in Step 1.
          "region_id" : ""           # The region ID where the CMK is located.
    }}

Cloud Monitor:Data encryption

Prerequisites

Data encryption mechanisms

SLS service key

Bring your own key (BYOK)

Limitations

Encryption with an SLS service key

Encryption with bring your own key (BYOK)

Prerequisites

Step 1: Grant BYOK permissions

Step 2: Configure data encryption

Related documents