PolarDB:Integrate the Go driver

How it works

1. Install the driver. It registers itself under the encmysql driver name.

2. Open a connection with sql.Open("encmysql", dsn), embedding the MEK and encryption algorithm (ENC_ALGO) in the connection string.

3. The driver processes the MEK locally and protects it with envelope encryption before sending any data to the server. The server never sees the key in plaintext.

Prerequisites

Before you begin, make sure you have:

• The always-confidential feature enabled on your PolarDB cluster, with encryption rules configured. See Enable the always-confidential feature

• Connection details for your confidential database: hostname, port, database name (dbname), username, and password

• Go 1.18 or later installed

Install the driver

Run the following command in your project directory:

go get github.com/aliyun/alibabacloud-encdb-mysql-go-client@latest

The driver is open source. For the source code, see alibabacloud-encdb-mysql-go-client on GitHub.

Connect to a confidential database

Use the following DSN format with sql.Open:

<username>:<password>@tcp(<hostname>:<port>)/<dbname>?MEK=<mek>&ENC_ALGO=<enc-algo>

Replace the placeholders with your actual values:

To add multiple query parameters, separate them with &.

In code:

db, err := sql.Open("encmysql", "<username>:<password>@tcp(<hostname>:<port>)/<dbname>?MEK=<mek>&ENC_ALGO=<enc-algo>")
if err != nil {
    log.Fatal("failed to open database connection:", err)
}
defer db.Close()

if err = db.Ping(); err != nil {
    log.Fatal("failed to reach database:", err)
}

sql.Open is lazy and does not establish a connection immediately. Call db.Ping() afterward to verify that the connection is live.

MEK and ENC_ALGO parameters

Example

The following example creates a table, inserts a row, and reads it back. The only difference from a standard Go MySQL application is the driver name (encmysql) and the MEK and ENC_ALGO parameters in the DSN.

Initialize the project:

go mod init demo
go get github.com/aliyun/alibabacloud-encdb-mysql-go-client@latest

main.go:

package main

import (
    "database/sql"
    "fmt"
    "log"
    _ "github.com/aliyun/alibabacloud-encdb-mysql-go-client"
)

func main() {
    dsn := "<username>:<password>@tcp(<hostname>:<port>)/<dbname>?MEK=00112233445566778899aabbccddeeff&ENC_ALGO=SM4_128_CBC"

    db, err := sql.Open("encmysql", dsn)
    if err != nil {
        log.Fatal("failed to open connection:", err)
    }
    defer db.Close()

    if err = db.Ping(); err != nil {
        log.Fatal("failed to reach database:", err)
    }

    _, err = db.Exec("DROP TABLE IF EXISTS test")
    if err != nil {
        log.Fatal(err)
    }

    _, err = db.Exec("CREATE TABLE test (a INT, b TEXT, c FLOAT)")
    if err != nil {
        log.Fatal(err)
    }

    _, err = db.Exec("INSERT INTO test SET a = 0, b = 'test', c = 0.0")
    if err != nil {
        log.Fatal(err)
    }

    rows, err := db.Query("SELECT * FROM test")
    if err != nil {
        log.Fatal(err)
    }
    defer rows.Close()

    rows.Next()
    var a int
    var b string
    var c float32
    if err = rows.Scan(&a, &b, &c); err != nil {
        log.Fatal(err)
    }
    fmt.Printf("read data: %d %s %f\n", a, b, c)
}

Replace the connection placeholders with your actual cluster details. After running the code, the output is:

read data: 0 test 0.000000

This confirms the driver decrypted the data and returned it as plaintext.

What's next

• Configure additional encryption rules in the PolarDB console to protect specific columns.

• Store your MEK in a Key Management Service (KMS) or a secrets manager rather than hardcoding it in your application.

• Review the always-confidential feature documentation for column-level encryption rule configuration.