Hologres:Encrypt data at rest

How it works

Hologres encrypts and decrypts data with keys managed by KMS. The encryption mechanism works as follows:

• Hologres encrypts and decrypts stored data per database through KMS. Data is encrypted into ciphertext at the storage layer, and only the corresponding key can decrypt the data.

• KMS generates and manages your keys and keeps them secure.

• Hologres supports the AES256, AESCTR, and RC4 encryption algorithms.

• Hologres encrypts and decrypts data only with a Bring Your Own Key (BYOK). Two types of key material are supported: key material that KMS generates when you create a customer master key (CMK), and key material that you import.

  You create a BYOK key in KMS and select it in Hologres to encrypt a database. For more information about how to create a BYOK key in KMS, see Create a key.

• During data reads and writes, Hologres calls KMS API operations to get key information and caches the information for 24 hours by default.

Usage notes

• Encryption scope — Encryption at rest applies only to tables that you create after you enable the feature. Tables created before you enable the feature are not encrypted.

• Supported table types — Only column-oriented tables and the column-oriented part of row-column hybrid tables are encrypted. Other table types are not encrypted. After you enable encryption at rest, you can still create Hologres foreign tables in MaxCompute to read and write data.

• Table-level keys — Hologres V2.0 and later support a separate encryption setting for each table, so you can encrypt different tables with different KMS keys. For more information, see Table-level encryption settings.

• Performance — Encryption and decryption add processing overhead. Encryption at rest reduces query and write performance by about 20% to 40%, depending on query characteristics.

• Key operations — KMS key operations such as disabling or deleting a BYOK affect Hologres encryption and decryption. Because Hologres caches key information, these operations take effect within 24 hours.

• Key availability — If the KMS key used by an encrypted table is disabled or invalid, the table becomes unreadable and unwritable.

• Key replacement — Hologres does not support switching the KMS key of a database that is already encrypted. To encrypt data with a different key, create a new database and migrate the data to it. For more information, see Rotate the KMS key and migrate data.

• Disabling encryption — Disabling encryption at rest for a database does not decrypt data that is already encrypted. For more information, see Disable encryption at rest for a database.

Billing

Encryption at rest incurs KMS fees because Hologres calls KMS API operations to get key information. For pricing information, see KMS billing.

Prerequisites

• Your Hologres instance runs V1.1 or later. Only Hologres V1.1 and later support encryption at rest. If your instance runs an earlier version, upgrade the instance. For upgrade preparation errors, see Troubleshooting upgrade preparation errors, or join the Hologres DingTalk group for support. For more information, see How do I get more online support?.

• Instances earlier than V1.3.31 require backend configurations for encryption at rest. Instances of V1.3.31 and later do not. (Recommended) Upgrade your instance.

• KMS is activated in your region.

• A RAM role is created. You specify the name of this role in the encryption setting.

Enable encryption at rest for a database

1. Create a custom policy that grants Hologres the required KMS permissions.

   1. Log on to the RAM console. In the left-side navigation pane, choose Permissions > Policies. On the Policies page, click Create Policy.

      

   2. On the Create Policy page, click JSON. In the code editor, enter the following policy, then set Name to AliyunHologresEncryptionDefaultRolePolicy.

      

      This policy grants Hologres the KMS permissions it needs to obtain and decrypt data keys when querying encrypted MaxCompute data.

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "kms:Encrypt",
                      "kms:Decrypt",
                      "kms:GenerateDataKey",
                      "kms:DescribeKey"
                  ],
                  "Resource": "acs:kms:*:*:*/*",
                  "Effect": "Allow"
              }
          ]
      }

   3. Click OK. The custom policy is created.

2. Create a RAM role for Hologres and attach the policy.

   Hologres needs a RAM role to call KMS APIs on your behalf. Create the role and attach the policy created in step 1.

   1. Log on to the RAM console. In the left navigation pane, choose Identities > Roles.

   2. On the Roles page, click Create Role. Set Principal Type to Cloud Service and Principal Name to Hologres.

   3. Click OK. In the dialog, enter AliyunHologresEncryptionDefaultRole in the Role Name field, then click OK.

      

   4. On the role details page, click Grant Permission.

   5. In the Grant Permission panel, set Resource Scope to Account. For Policy, select AliyunHologresEncryptionDefaultRolePolicy.

      

   6. Click OK. On the role details page, click the Trust Policy tab to verify the trust policy.

3. Create a key.

   For details, see Create a key.

   Hologres supports only symmetric keys of the Aliyun_AES_256 type.

4. Configure the encryption setting.

   1. Connect to the database instance for which you want to enable encryption at rest. For instructions, see Connect to a database instance.

   2. On the Ad-hoc Query page, set Instance Name and Database, enter the following statement in the SQL query editor, and then click Run.

ALTER DATABASE <db_name> SET hg_experimental_encryption_options='<encryption_type>,<cmk_id>,<ram_role>,<uid>';

Disable encryption at rest for a database

If you run the following statement to disable encryption at rest for a database, data in tables created before you disabled it remains encrypted. Only tables created after you disable it are unencrypted.

ALTER DATABASE <database_name> set hg_experimental_encryption_options='';

Table-level encryption settings

Starting from Hologres V2.0, after encryption at rest is enabled for a database, you can configure a different encryption policy for individual tables. Tables can remain unencrypted or use a KMS key other than the database default.

Configure a table-level encryption setting when tables in the same database must use different KMS keys, or when specific tables must remain unencrypted.

CALL SET_TABLE_PROPERTY('<table_name>', 'encryption_options', '<encryption_type>,<cmk_id>,<ram_role>,<uid>');

BEGIN;
CREATE TABLE LINEITEM
(
    L_ORDERKEY      BIGINT      NOT NULL,
    L_PARTKEY       INT         NOT NULL,
    L_SUPPKEY       INT         NOT NULL,
    L_LINENUMBER    INT         NOT NULL,
    L_QUANTITY      DECIMAL(15,2) NOT NULL,
    L_EXTENDEDPRICE DECIMAL(15,2) NOT NULL,
    L_DISCOUNT      DECIMAL(15,2) NOT NULL,
    L_TAX           DECIMAL(15,2) NOT NULL,
    L_RETURNFLAG    TEXT        NOT NULL,
    L_LINESTATUS    TEXT        NOT NULL,
    L_SHIPDATE      TIMESTAMPTZ NOT NULL,
    L_COMMITDATE    TIMESTAMPTZ NOT NULL,
    L_RECEIPTDATE   TIMESTAMPTZ NOT NULL,
    L_SHIPINSTRUCT  TEXT        NOT NULL,
    L_SHIPMODE      TEXT        NOT NULL,
    L_COMMENT       TEXT        NOT NULL,
    PRIMARY KEY (L_ORDERKEY,L_LINENUMBER)
);
CALL SET_TABLE_PROPERTY('LINEITEM', 'encryption_options', 'AES256,623c26ee-xxxx-xxxx-xxxx-91d323cc4855,AliyunHologresEncryptionDefaultRole,153xxxxxxxxxxxxx');
COMMIT;

SELECT
    *
FROM
    hologres.hg_table_properties
WHERE
    property_key = 'encryption_options';

Rotate the KMS key and migrate data

Hologres does not support switching the KMS key of a database that is already encrypted. Data encrypted with a key can be decrypted only by that key, and a database can have only one effective encryption setting at the database level. If you run ALTER DATABASE on an encrypted database to point to a new key, the statement may return successfully without an error, but the key is not switched and existing data is still decrypted with the original key.

To replace the KMS key, for example when the current key is about to be deactivated, create a database with the new encryption setting and migrate the data to it. This procedure applies to the database-level encryption setting.

Migrate the data in the following order:

1. Create a new database.

2. Configure the new KMS encryption setting for the new database. Use the same syntax as in Enable encryption at rest for a database.

   ALTER DATABASE <db_name> SET hg_experimental_encryption_options='<encryption_type>,<cmk_id>,<ram_role>,<uid>';

3. Use a data synchronization task, such as a Flink or DataWorks task, to migrate data from the old database to the new database.