This topic describes how to share a Key Management Service (KMS) instance from one Alibaba Cloud account to another, and then use the centralized multi-account management feature in Data Security Center (DSC) to synchronize RDS MySQL assets, run sensitive data discovery tasks, and configure column encryption based on a KMS key. This solution enables centralized key management and unified data security governance across multiple accounts.
Use cases
We recommend this solution if your enterprise meets the following requirements:
You manage multiple Alibaba Cloud accounts and need a centralized KMS instance for key management across all accounts.
You want a single management account to govern RDS MySQL data assets across member accounts through Data Security Center.
You need to configure Column Encryption for RDS MySQL instances in member accounts, using the KMS Key encryption method.
This solution involves two independent configuration paths:
KMS sharing path: Enables a business account to use the key capabilities of a KMS instance owned by another account.
DSC multi-account management path: Enables a management account to discover, scan, and govern RDS assets in business accounts through Data Security Center.
Both paths must be fully configured before you can enable Column Encryption based on a KMS Key for the RDS MySQL instance in the business account through the Data Security Center console.
Account roles
This solution involves three account roles:
Role | Account | Responsibilities |
Central management account | A | Manages data assets of member accounts through Data Security Center, performs Asset synchronization, runs data classification tasks, and configures Column Encryption |
KMS instance owner | B | Owns and maintains the KMS instance, and shares it with the business account through Resource Sharing |
Business resource account | C | Owns RDS MySQL instances that support Column Encryption, and acts as both a KMS instance consumer and a DSC member account |
If account A is the management account of a resource directory, you must first set eligible member accounts as DSC delegated administrators. In this case, references to "the Data Security Center console of account A" refer to either the centralized management console or the console of the DSC delegated administrator account.
Prerequisites
Before you begin, ensure that the following conditions are met:
Accounts and organization
Accounts A, B, and C belong to the same resource directory and share the same enterprise real-name verification entity.
Account A has resource directory management capabilities, or has been configured as a DSC delegated administrator as required.
KMS resources
Account B has activated a software KMS instance or a hardware KMS instance.
DSC resources
The central management account has activated a paid Data Security Center instance that supports Multi-account Management.
Account C can be managed as a DSC member account, and the target RDS assets in account C are authorized for DSC access.
Database instances
Account C owns an RDS MySQL instance that supports Column Encryption, and the instance is in the Running state.
The database version, minor engine version, storage type, and region of the instance meet the requirements for column encryption. For detailed requirements, see Configure column encryption.
Configuration overview
Complete the configuration in the following order. First, establish the KMS sharing relationship, then set up DSC multi-account management, and finally synchronize assets, run discovery tasks, and configure Column Encryption through Data Security Center.
Step | Account | Description |
1. Share the KMS instance | B | Share the KMS instance with account C through Resource Sharing |
2. Prepare the KMS key | C | Confirm the shared KMS instance is visible and prepare an available symmetric key |
3. Configure multi-account management | A | Add account C as a member account through Data Security Center |
4. Synchronize RDS assets | A | Synchronize RDS assets from account C through Data Security Center |
5. Run a discovery task | A | Run a sensitive data discovery task on the target database |
6. Configure column encryption | A | Select KMS Key to configure Column Encryption |
Prepare the KMS key for column encryption
Operating account: C (business resource account)
Log on to the KMS console as account C and navigate to the Instances page to confirm the shared KMS instance is visible.
Open the shared KMS instance and create or confirm an available symmetric key. Column encryption requires a symmetric key type.
Prepare the necessary KMS permissions for the RAM identity that will perform subsequent operations. At minimum, grant
kms:Encryptandkms:Decryptpermissions.
If your enterprise requires centralized key management, confirm whether the sharing mode is independent ownership or joint ownership.
Configure DSC multi-account management
Operating account: A (central management account) or DSC delegated administrator
Follow Use the multi-account management feature to configure Resource Directory, trusted service, delegated administrator, and member accounts.
Log on to the Data Security Center console. In the left-side navigation pane, click Multi-account Management.
If multi-account management is not activated, click Enable Multi-account Management.
Click Add Member. In the panel that appears, select account C from the Available Members list on the left, move it to the Selected Members in DSC list on the right, and click OK.
If account A is a Resource Directory management account, you must first set eligible member accounts as DSC delegated administrators. Member accounts that have already purchased a DSC instance are typically not added as managed member accounts. Review the official documentation constraints to confirm your account planning.
Synchronize RDS assets
Operating account: A (central management account) or DSC delegated administrator
Log on to the Data Security Center console and complete the authorization for DSC to access cloud resources.
In the left-side navigation pane, click Asset Center to go to the Asset Authorization Management page.
Click Asset synchronization and wait for the system to complete data synchronization. A message indicating "Data is being synchronized. Refresh the page later." appears on the page during synchronization.
Check the structured data asset list and confirm that the target RDS MySQL instance from account C appears in the list.
After you first activate Data Security Center, the system automatically synchronizes cloud assets. If you just added a member account or changed an instance status, we recommend manually triggering Asset synchronization. If the instance does not appear, check the DSC member account relationship, Resource Directory relationship, RDS region, and instance running status.
Run a sensitive data discovery task
Operating account: A (central management account) or DSC delegated administrator
Go to the Asset Center, select the target RDS MySQL instance, and authorize the database connection. Both one-click connection and username-password connection are supported.
After the connection succeeds, enable data classification through the database connection management.
Run the sensitive data discovery task. Only after the discovery task completes can Data Security Center display the governable databases, tables, and columns on the Column Encryption page.
To continuously scan for the latest data, set the database account used by Data Security Center for discovery tasks to a Plaintext Permission Accounts.
If you choose to automatically create a system default task for scanning, you can view the scan progress by navigating to Data classification > Task management > Discovery tasks.
Configure column encryption
Operating account: A (central management account) or DSC delegated administrator
Log on to the Data Security Center console. Navigate to Risk governance > Column Encryption.
Confirm that the Encryption Check status for the target RDS MySQL instance shows Passed. If not, complete the required fixes for the database version, minor engine version, storage type, or instance status as prompted, and then trigger Asset synchronization again.
Click Rapid Encryption to open the encryption configuration panel, and configure the following parameters.
Parameter
Description
Asset type
Select the asset type of the target RDS MySQL instance.
Region
Select the region where the target instance is deployed.
Instance name
Select the RDS MySQL instance for which you want to configure Column Encryption.
Encryption Algorithm
Select the encryption algorithm.
Encryption Method
Select KMS Key. The KMS Key encryption method is supported only for RDS MySQL instances.
KMS Key
Select the KMS symmetric key to use for Column Encryption. The list displays keys in the Enabled state. If no key is created, the system prompts "No KMS key is detected." In this case, create a symmetric key in the KMS console first.
Plaintext Permission Accounts
Select the database account that can view plaintext data in encrypted columns. Accounts not selected here access encrypted columns with ciphertext-only permissions.
Select the target databases, tables, and columns to encrypt, and click Submit.
Confirm the Encryption Method before submitting. Subsequent changes to the Encryption Method may trigger a restart of the encryption task, during which encrypted column data may be stored in plaintext form.
Verify the configuration
After configuration completes, verify the following items:
KMS verification
The KMS console for account C displays the KMS instance shared from account B.
The symmetric key used for Column Encryption exists, and the relevant RAM identity has the required KMS permissions.
DSC verification
Account C is managed as a DSC member account by the central management account.
The target RDS MySQL instance from account C is visible in the Asset Center.
Scan verification
The target database has completed connection authorization and the data classification discovery task.
The Column Encryption page displays the target databases, tables, columns, and sensitivity level information.
Encryption verification
The target instance shows Passed for Encryption Check, and the Column Encryption status updates to Encrypted after configuration is submitted.
Access the encrypted columns with accounts of different permission levels and confirm that the returned results match the expected behavior for Plaintext Permission Accounts or ciphertext permissions.
Cross-account constraints and risks
Item | Description |
Account relationships | Both KMS instance sharing and DSC Multi-account Management depend on Resource Directory relationships and the same enterprise real-name verification entity. If accounts are not in the same organization, complete Resource Directory management first. |
Relationship between KMS and DSC | Sharing a KMS instance does not automatically synchronize RDS assets to Data Security Center. Similarly, adding account C to DSC does not automatically complete KMS sharing. Both paths must be configured separately. |
Prerequisite: run discovery before encryption | Before configuring Column Encryption, the target database must complete DSC authorization access, Asset synchronization, and the sensitive data discovery task. Otherwise, the Column Encryption page may not display configurable columns. |
KMS Key encryption mode | Before selecting KMS Key as the Encryption Method, prepare an available KMS symmetric key and confirm that the RDS MySQL version, minor engine version, storage type, and region meet the official restrictions. |
Plaintext Permission Accounts | After column encryption is configured, accounts not added to the whitelist access encrypted columns with ciphertext-only permissions. If Data Security Center still needs to read the latest database data for data classification, configure the database account used by DSC as a Plaintext Permission Accounts. |
Change risks | After column encryption is configured, avoid modifying the Encryption Method. Modifications may trigger a task restart, during which encrypted column data may be stored in plaintext form. |