Hologres:Encrypt data at rest

Important notes

• Only Hologres V1.1 and later support encryption at rest. If your instance is running an earlier version, upgrade your instance or get online support.

• For an instance earlier than V1.3.31, you must add backend configurations to use encryption at rest. We recommend upgrading your instance.

• Operations on your Bring Your Own Key (BYOK) in KMS, such as disabling or deleting the key, will affect encryption and decryption in Hologres. Due to caching in Hologres, changes you make in KMS take effect within 24 hours.

• Encryption at rest applies only to tables created after you enable the feature. Existing tables are not automatically encrypted.

• After you enable encryption at rest, you can still map tables to MaxCompute for data reads and writes.

• Disabling encryption at rest using the provided SQL statement does not decrypt existing data. Only new tables created after disabling encryption will be unencrypted.

  ALTER DATABASE <database_name> set hg_experimental_encryption_options='';

• If the KMS key for an encrypted table becomes disabled or invalid, you will be unable to read from or write to that table.

• Starting with Hologres V2.0, you can configure separate encryption setting per table.

• Encryption at rest is supported for columnar tables and the columnar parts of hybrid row-column store tables. After the feature is enabled, Hologres foreign tables in MaxCompute can still be created for data access, but only data in supported table types will be encrypted.

How it works

Procedure

1. Create a custom policy.

   1. Log on to the Resource Access Management (RAM) console. In the left-side navigation pane, choose Permissions > Policies. On the Policies page, click Create Policy.

      

   2. On the Create Policy page, click JSON. On the JSON tab, enter the following script in the code editor and set Name to AliyunHologresEncryptionDefaultRolePolicy.

      

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "kms:Encrypt",
                      "kms:Decrypt",
                      "kms:GenerateDataKey",
                      "kms:DescribeKey"
                  ],
                  "Resource": "acs:kms:*:*:*/*",
                  "Effect": "Allow"
              }
          ]
      }

   3. Click OK. The custom policy is created.

2. Create a RAM role and grant permissions to the RAM role.

   1. Log on to the RAM console. In the left navigation pane, choose Identities > Roles.

   2. On the Roles page, click Create Role. On the Create Role page, set Principal Type to Cloud Service, and Principal Name to Hologres.

   3. Click OK. In the dialog, enter AliyunHologresEncryptionDefaultRole in the Role Name field, and click OK.

   4. On the role details page, click Grant Permission.

   5. In the Grant Permission panel, set Resource Scope to Account. For Policy, select the custom policy AliyunHologresEncryptionDefaultRolePolicy created in step 1.

   6. Click OK.

      On the role's details page, click the Trust Policy tab to check the trust policy.

3. Create a key.

   For details, see Getting started with keys.

   Important

   Hologres supports only symmetric keys of the Aliyun_AES_256 type.

4. Enable encryption for a database.

   1. Connect to your Hologres database for which you want to enable encryption at rest. For more information, see Log on to a database.

   2. Choose SQL Editor in the top navigation menu. On the Ad-hoc Query page, set Instance Name and Database. Enter the following statement in the SQL editor and click Run.

      ALTER DATABASE <db_name> SET hg_experimental_encryption_options='<encryption_type>,<cmk_id>,<ram_role>,<uid>';

      Parameter description:

      Parameter	Description
      db_name	The database name.
      encryption_type	The encryption algorithm. Valid values include AES256, AESCTR, and RC4.
      cmk_id	The key ID, obtained from the key details page in the KMS console.
      ram_role	The RAM role name you created.
      uid	Your Alibaba Cloud Account ID. For more information, see View the account ID.

   Example:

   1. Enable encryption at rest for the database hoxxxx.

      ALTER DATABASE hoxxxx set hg_experimental_encryption_options=
      'AES256,623c26ee-xxxx-xxxx-xxxx-91d323cc4855,AliyunHologresEncryptionDefaultRole,187xxxxxxxxxxxxx';

   2. Create a table and insert data.

      DROP TABLE IF EXISTS a;
      
      CREATE TABLE a(id int);
      
      INSERT INTO a values(1);
      
      SELECT hg_admin_command('flush'); -- For testing only. This lets you see the query result immediately.

   3. Query the data.

      SELECT * FROM a;

      The following result is returned.

   If you disable the key and restart the instance or query table a after 24 hours, an error is reported.

Table-level encryption settings

Starting with Hologres V2.0, you can apply distinct encryption policies to individual tables within an encrypted database. This allows for flexibility, enabling you to choose whether certain tables remain unencrypted or are encrypted with a unique KMS key.

SELECT
    *
FROM
    hologres.hg_table_properties
WHERE
    property_key = 'encryption_options';