All Products
Search

This Product

    PolarDB:Disk encryption

    Document Center

    PolarDB:Disk encryption

    Last Updated:Sep 22, 2026

    PolarDB for MySQL provides free disk encryption based on block storage. It encrypts the entire data disk so that even if a data backup is leaked, the data cannot be decrypted. You do not need to modify your applications, and snapshots automatically inherit the encryption property.

    Applicable scope

    • Cluster configuration:

      • Edition: Standard Edition.

      • Minor version: General-purpose or Dedicated.

      • CPU architecture: Yitian ARM or x86.

      • Storage type: ESSD PL0, ESSD PL1, ESSD PL2, ESSD PL3, or ESSD AutoPL disk.

        Note

        Disk encryption can only be enabled when you purchase a cluster. It cannot be enabled after purchase.

    • Key: Only the default key (Default Service CMK) is supported. Custom KMS keys are not supported.

    • Create the PolarDB service-linked role.

      Check whether a PolarDB service-linked role has been created

      1. Log on to the RAM console using your Alibaba Cloud account and go to Identity Management > Role list.

      2. In the role list, check whether a service-linked role named AliyunServiceRoleForPolarDB exists, as follows: enter the role name AliyunServiceRoleForPolarDB in the search box and confirm the service-linked role appears in the list.

        • If it exists, skip this check.

        • If it does not exist, proceed with the following steps.

      3. Click Create Role. On the Create Role page that opens, click Create Service-linked Role in the upper-right corner.

      4. On the Create Service-linked Role page that opens, set Trusted Cloud Service to AliyunServiceRoleForPolarDB and click Create Service-linked Role to complete the creation.

    Precautions

    • Disk encryption cannot be disabled after it is enabled.

    • Disk encryption does not affect your business. No application changes are required.

    • After disk encryption is enabled, snapshots generated by the cluster and Standard Edition clusters created from those snapshots automatically inherit the encryption property.

    Billing

    Disk encryption is a free feature. Read and write operations on encrypted disks do not incur additional charges.

    Enable disk encryption

    When purchasing a cluster, if the Applicable scope requirements are met, you can select Enable Disk Encryption after choosing a storage type, and then select the default key (Default Service CMK).

    Verify disk encryption status

    1. Log in to the PolarDB console，In the navigation pane on the left, click Clusters. Select the Region where the cluster is deployed, and then click the cluster ID to go to the cluster details page。

    2. In the left navigation pane, choose Settings and Management > Security.

    3. Click the Cloud Drive Encryption tab. If Data disk encryption status: shows Encrypted, disk encryption is enabled for the cluster.