Configure TDE

Note

• In I/O bound scenarios, TDE may adversely affect the performance of your databases.
• You cannot enable TDE for clusters that are connected to a global database network (GDN). Clusters for which TDE is enabled cannot be connected to a GDN.

Procedure

1. Log on to the PolarDB console.
2. In the upper-left corner of the console, select the region where the cluster that you want to manage is deployed.
3. Find the cluster you want to manage and click the cluster ID.
4. In the left-side navigation pane, choose Settings and Management > Security Management.
5. On the TDE Settings tab, turn on TDE Status.
   
6. In the Configure TDE dialog box, select Use Default Key of KMS or Use Existing Custom Key.
   

   Note TDE supports the following keys: Aliyun_AES_256 and Aliyun_SM4.
   • In the dialog box that appears, select Use Default Key of KMS and click OK.
   • If you choose Use Existing Custom Key, select a key generated by KMS from the drop-down list and click OK.
     Note

     • If you do not have a custom key, click Create Custom Key. In the KMS console, create a key and import your key materials. For more information, see Create a CMK.
     • When you use an existing custom key, you must take note of the following limits:
       • If you disable a key, configure a key deletion plan, or delete the key materials, the key becomes unavailable.
       • If you revoke the authorization to a cluster of the ApsaraDB PolarDB MySQL-compatible edition, the cluster becomes unavailable after you restart the cluster.
       • You must use an Alibaba Cloud account or an account that has the AliyunSTSAssumeRoleAccess permission.
   It requires approximately 10 minutes to enable TDE.

Advanced settings

When you enable TDE, you can enable the Advanced Settings feature in the Configure TDE dialog box. After this feature is enabled, all newly created tables are automatically encrypted.

Encrypt and decrypt tables

alter table <tablename> block_format=encrypted;

alter table <tablename> encryption= 'Y';

alter table <tablename> block_format=default;

alter table <tablename> encryption= 'N';