Configure column encryption for an RDS database or a PolarDB database - Data Security Center

Data Security Center (DSC) encrypts specific columns in your databases so that sensitive data — such as phone numbers, passwords, and identity documents — is stored as ciphertext. Authorized users can decrypt and read the plaintext through an always-confidential client.

Supported databases: RDS for MySQL, RDS for PostgreSQL, PolarDB for MySQL, PolarDB for PostgreSQL, PolarDB for PostgreSQL (Compatible with Oracle), and PolarDB-X 2.0.

Important

Column encryption is available in the Free, Premium, Enterprise, 7-day Trial, and Value-added Service Only editions of DSC. To add this feature or increase your quota, upgrade your DSC edition.

Before you begin

Read these constraints before you start. They affect decisions you make during configuration and cannot be changed without risk.

Data type change: When you query encrypted columns via SQL, DSC ignores the original data type. All values are returned as strings, regardless of the original type.

Encryption method change is destructive: Changing the encryption method causes DSC to restart the encryption task. During the restart, the originally encrypted data is temporarily stored in plaintext, creating a risk of data exposure. Choose your encryption method before enabling encryption and avoid changing it afterward.

PolarDB for MySQL endpoint requirement: Column encryption policies apply only to connections through the database proxy endpoint (read/write splitting mode). Connections through the primary endpoint bypass the policy.

Prerequisites

Before you begin, make sure that:

You have purchased DSC and have sufficient column encryption authorization quota.
The region where your database instance is located supports column encryption. See Supported regions.

Supported databases and limits

Version and algorithm requirements

Database	Supported versions	Supported algorithms	Encryption methods
RDS for MySQL	MySQL 5.7 or 8.0 (minor engine version 20240731 or later)	AES_128_GCM (all versions); AES_256_GCM and SM4_128_GCM (minor engine version 20241231 or later). Outside the Chinese mainland: AES_128_GCM only.	Local key; KMS key (minor engine version 20241231 or later, disk storage only)
RDS for PostgreSQL	PostgreSQL 16 (minor engine version 20241230 or later)	AES_256_GCM	Local key
PolarDB for MySQL	MySQL 5.7 or 8.0 (database proxy version 2.8.36 or later)	AES_128_GCM	Local key
PolarDB for PostgreSQL	PostgreSQL 14 (database version 2.0.14.15.31.0 or later)	AES_256_GCM	Local key
PolarDB for PostgreSQL (Compatible with Oracle)	Oracle syntax compatibility 2.0, PostgreSQL 14 (database version 2.0.14.15.31.0 or later)	AES-256-GCM	Local key
PolarDB-X 2.0	Version polardb-2.5.0_5.4.20-20250714_xcluster8.4.20-20250703 or later	AES-128-GCM, SM4-128-GCM	Local key

Account permissions per database type

Database	Default permission	Available permissions
RDS for MySQL (local key)	Ciphertext Permission (No Decryption Permission)	Ciphertext Permission (No Decryption Permission), Ciphertext Permission (JDBC Decryption), Plaintext Permission
RDS for MySQL (KMS key)	Ciphertext Permission (JDBC Decryption)	Ciphertext Permission (JDBC Decryption), Plaintext Permission
RDS for PostgreSQL	Ciphertext Permission (JDBC Decryption)	Ciphertext Permission (JDBC Decryption), Plaintext Permission
PolarDB for MySQL	Ciphertext Permission (JDBC Decryption)	Ciphertext Permission (JDBC Decryption), Plaintext Permission
PolarDB for PostgreSQL	Ciphertext Permission (JDBC Decryption)	Ciphertext Permission (JDBC Decryption), Plaintext Permission
PolarDB for PostgreSQL (Compatible with Oracle)	Ciphertext Permission (JDBC Decryption)	Ciphertext Permission (JDBC Decryption), Plaintext Permission
PolarDB-X 2.0	Ciphertext Permission (JDBC Decryption)	Ciphertext Permission (JDBC Decryption), Plaintext Permission

Limitations

Column encryption cannot be configured on read-only instances. Configure encryption on the primary instance; changes replicate automatically to all read-only instances.
Column encryption cannot be configured on instances that are paused or under maintenance. Wait until the instance status is Running.start the instance
Instances that do not meet the minimum version requirement fail the Encryption Check. Upgrade the database before proceeding.
Outside the Chinese mainland, only AES_128_GCM is supported for RDS for MySQL.
For PolarDB for MySQL, you must connect through the database proxy endpoint. The primary endpoint does not enforce encryption policies.

Configure column encryption

If this is your first time using DSC after purchasing an instance, complete all five steps in sequence. If you have already authorized cloud resources and synced assets, start at Step 3.

Step 1: Authorize DSC to access cloud resources

Log on to the DSC console.
In the RAM Authorization dialog box, click Authorize Now.

DSC can then access resources from services such as OSS, RDS, and MaxCompute.

Step 2: Sync database assets

In the left navigation pane, click Asset Center.
On the Asset Center page, click Asset synchronization.

After you purchase a DSC instance, asset synchronization runs automatically the first time you log on. DSC also syncs the asset list automatically at midnight every day.

Step 3: Connect the database and run data classification

DSC must complete a data classification scan before you can enable column encryption. Connect the database using one of two methods:

Connection method	How it works	Supported data assets
One-click connection	DSC automatically creates a read-only account (prefix: `sddp_auto`) in the target database. Because this account is read-only, the database cannot serve as a destination for data masking tasks.	RDS for MySQL, RDS for SQL Server (primary instances only), RDS for MariaDB (primary instances only), PolarDB for MySQL, PolarDB-X 1.0 (DRDS), PolarDB-X 2.0 (primary instances only), OSS, Tablestore, MaxCompute, Simple Log Service (SLS)
Credential-based connection	Connect using a database account and password you provide. A read-only account supports detection, masking, and audit tasks, but the database cannot be a masking destination. An account with read/write permissions allows the database to be used as a masking destination.	Structured data: RDS, PolarDB, PolarDB-X (formerly DRDS), PolarDB-X 2.0, ApsaraDB for MongoDB, ApsaraDB for OceanBase, and self-managed databases. Big data: AnalyticDB for MySQL and AnalyticDB for PostgreSQL.

To connect a database and start classification:

In the left navigation pane, click Asset Center.
In the Structured Data area, click the database type you want to encrypt.
In the Classification and Grading column of the target instance, click .
The instance status must be Running and at least one database must exist in the instance. If no database exists, you cannot enable the data classification feature.

In the Enable Classification and Grading dialog box, configure the parameters:

Parameter	Description
Activation Method	Choose Automatically create database accounts to let DSC create a read-only `sddp_auto` account, or Manually enter username and password to provide your own credentials. Automatic creation is available only for data types that support one-click enablement.
Authorization Scope	Select Entire data source, or select Manage authorization scope in the data source list to specify which databases to include.
Automatically create and start a default scan task	DSC creates and starts a default scan task after the connection succeeds. View results on the Classification and Grading > Tasks > Identification Tasks tab under Default Tasks.
Automatically connect to new databases.	DSC automatically connects to new databases detected in the instance after each asset sync.

Click OK.

Step 4: Review database encryption status

After classification completes, review the encryption readiness of each database instance.

In the left navigation pane, choose Risk Governance > Column Encryption.

On the Column Encryption page, review the following information:

Field	Description
Columns	Total number of columns across all connected database instances.
Sensitive Data (S3 and Higher)	Columns classified at sensitivity level S3 or above, broken down by encrypted, unencrypted, and failed.
Accounts	Total Accounts: each account per database counts separately. Accounts For Which No Encryption Configured: accounts with no encryption policy set. Plaintext Permission and Ciphertext Permission counts: accounts with each permission type. Click any count or click Permission Settings to view full account details.
List information	Instance name, asset type, region, encryption algorithm, plaintext permission accounts, and Encryption Check result.

Sensitivity level reference:

Level	Meaning
N/A	No sensitive information detected
S1	Non-sensitive (examples: provinces, cities, product names)
S2	Moderately sensitive (examples: names, addresses)
S3	Highly sensitive (examples: identity documents, passwords, database credentials)
S4	Core confidential (examples: biometric data such as genes, fingerprints, iris scans)

Check the Encryption Check column for each instance:
- Passed: the instance is ready for column encryption configuration.
- Failed: the database version is incompatible. Click Go To Upgrade to open the upgrade page in the RDS or PolarDB console. After upgrading, sync assets again: go to Asset Center, on the Authorization Management tab, click Asset Authorization Management. In the Asset Authorization Management panel, click the target instance type (RDS or PolarDB), and then click Asset synchronization.

Step 5: Enable column encryption

After confirming that the Encryption Check status is Passed, configure column encryption.

Enable encryption with Rapid Encryption

Use one of these three entry points to open the Encryption Configuration panel:

Click Rapid Encryption above the database instance list to encrypt all unencrypted columns across all instances.
In the Actions column for a specific instance, click Rapid Encryption.
On the Asset Center page, click in the Column Encryption column for the target instance.
Authorize access to a database

In the Encryption Configuration panel, select the Asset Type, Instance name, Encryption Algorithm, Encryption Method, and Plaintext Permission Accounts. Then select the target Databases, Table, and Column, and click OK.

Encryption method notes:

If you select KMS Key, first create a symmetric key in Key Management Service (KMS).
> Important: Changing the encryption method after it is set causes DSC to restart the encryption task. During the restart, data in the encrypted columns is temporarily stored in plaintext. Finalize your encryption method before enabling encryption.

Plaintext Permission Accounts notes:

After you enable encryption, all database accounts default to ciphertext permission. To allow specific accounts to read plaintext directly, add them to the plaintext permission allowlist.

Important

The DSC service account — either sddp_auto (one-click connection) or the account you provided (credential-based connection) — must have Plaintext Permission so that DSC can continue to read the latest data for classification scans.

More operations

Modify account permissions

By default, all accounts except those explicitly granted Plaintext Permission have ciphertext permission. To change permissions:

On the Risk Governance > Column Encryption page, click Permission Settings in the Accounts area. Alternatively, click Edit in the Actions column for the instance, then click Configure next to Account Permissions.
In the Permission Settings panel, find the target instance and account.
If a new account does not appear in the list, run Asset synchronization and check again.
In the Actions column for the account, click Modify Permissions. To update multiple accounts at once, select accounts with the same current permission and click Batch Modify Permissions.
Select the target permission and click OK.

Available permissions: Plaintext Permission, Ciphertext Permission (No Decryption Permission), or Ciphertext Permission (JDBC Decryption).

Update the encrypted column scope or algorithm

After encryption is configured, you can adjust the scope or algorithm.

To toggle encryption for a single column: in the instance list, expand the instance, locate the Databases, Table, and Column, then click Enable Encryption or Disable Encryption.
To update the algorithm, method, or encrypted column scope: in the Actions column for the instance, click Edit.
- Click Modify next to Encryption Algorithm or Encryption Method to update the setting.
- > Important: Changing the encryption method restarts the encryption task. During the restart, data in the encrypted columns is temporarily stored in plaintext. Proceed with caution.
- In the database list, locate the target Databases, Table, and Column, and click Enable Encryption or Disable Encryption.

Examples: Verify encrypted column access

After configuring column encryption, verify that permissions work as expected. An account with ciphertext permission should receive ciphertext when querying an encrypted column; an account with plaintext permission should receive the original values.

RDS for PostgreSQL accounts support only Plaintext Permission and Ciphertext Permission (JDBC Decryption). The verification approach is the same as for RDS for MySQL.

RDS for MySQL example

Setup: RDS for MySQL 8.0 instance connected to DSC, classification scan complete.

Column encryption configuration:

Enable encryption for the phone column in the users table.
Set access permissions for each database account.

Verify access:

Log on using an account with Plaintext Permission. See Log on to an RDS database using Data Management (DMS). Run a SELECT statement — the encrypted column returns plaintext.
Switch to an account with Ciphertext Permission (No Decryption Permission) and run the same SELECT statement — the encrypted column returns ciphertext.
Switch to an account with Ciphertext Permission (JDBC Decryption) and run the same SELECT statement — the encrypted column returns ciphertext.

PolarDB for MySQL example

Setup: PolarDB for MySQL 5.7 cluster connected to DSC, classification scan complete.

Column encryption configuration:

Enable encryption for the password column in the user3 table.
Set access permissions for each database account.

Verify access:

Because Data Management (DMS) connects to PolarDB for MySQL through the primary endpoint, column encryption policies do not take effect via DMS. Use a MySQL client to connect through the database proxy endpoint instead.

Install a MySQL client compatible with your operating system.
Connect to the cluster using the database proxy endpoint:
- Plaintext permission account: mysql -hpc-bp1fd7******v6f.rwlb.rds.aliyuncs.com -P3306 -usddp_polardb -pH******4
- Ciphertext Permission (JDBC Decryption) account: mysql -hpc-bp1fd7******v6f.rwlb.rds.aliyuncs.com -P3306 -usddp_03 -pP********3
```
mysql -h<endpoint> -P<port> -u<username> -p<password>
```
Example commands:
Run the following commands:
- Plaintext permission account — the encrypted column returns plaintext.
- Ciphertext Permission (JDBC Decryption) account — the encrypted column returns ciphertext.
```
use sddp_test;
SELECT * FROM user3 LIMIT 0, 3;
```

Access plaintext via an always-confidential client

Accounts with Ciphertext Permission (JDBC Decryption) can decrypt encrypted column data in application code using an always-confidential client.

Language	Supported databases	Reference
Java	RDS for MySQL, RDS for PostgreSQL, PolarDB for MySQL, PolarDB for PostgreSQL, PolarDB for PostgreSQL (Compatible with Oracle), PolarDB-X 2.0	Integrate EncJDBC — supports local keys and KMS keys
Go	RDS for MySQL, PolarDB for MySQL, PolarDB-X 2.0	Integrate the Go driver — supports local keys only

Troubleshooting: Encryption check failures

Database version not supported

Click Go To Upgrade in the Encryption Check column to open the upgrade page for the database. Upgrade guides:

Minor engine version or database proxy version not supported

Read-only instance

Column encryption must be configured on the primary instance. Data replicates automatically to all read-only instances, so you do not need to configure encryption separately on each.

Instance status is not Running

Wait for the instance to start or for maintenance to complete, then confirm the status is Running before configuring column encryption.

What's next

Understand how column encryption works: Column encryption overview
Connect additional databases: Database authorization
View and manage classification results: Scan for sensitive data