PolarDB:Authorize PolarDB to access Key Management Service (KMS)

1. Create the AliyunRDSInstanceEncryptionRolePolicy access policy

1. Log on to the Policy Management page of the RAM console.

2. Click Create Policy.

   Note

   An access policy is a set of permissions, defined in a specific syntax, that specifies authorized resources, actions, and conditions.

3. Click the JSON tab and copy the following policy into the code editor.

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "kms:List*",
                   "kms:DescribeKey",
                   "kms:TagResource",
                   "kms:UntagResource"
               ],
               "Resource": [
                   "acs:kms:*:*:*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "kms:Encrypt",
                   "kms:Decrypt",
                   "kms:GenerateDataKey"
               ],
               "Resource": [
                   "acs:kms:*:*:*"
               ],
               "Effect": "Allow",
               "Condition": {
                   "StringEqualsIgnoreCase": {
                       "kms:tag/acs:rds:instance-encryption": "true"
                   }
               }
           }
       ]
   }

4. Click OK. In the dialog box that appears, configure the following parameters:

   Parameter	Description
   Name	Enter AliyunRDSInstanceEncryptionRolePolicy.
   Remarks	Enter a description. For example: Allows PolarDB to access KMS.

5. Click OK.

2. Create the RAM role AliyunRDSInstanceEncryptionDefaultRole and grant permissions

After you create the policy, you must grant the policy to a RAM role so that PolarDB can access KMS resources.

1. Log on to the Roles page of the RAM console.

2. Click Create Role.

3. Select Alibaba Cloud Service. In the Trusted Entity Name drop-down list, select the entry whose suffix is rds.aliyuncs.com, namely ApsaraDB RDS, and then click OK.

4. In the Create Role panel, set RAM Role Name to AliyunRDSInstanceEncryptionDefaultRole and click OK.

5. After the role is created, you are redirected to the role details page. Click the Permissions tab, and then click Add Permissions.

6. In the Add Permissions panel, search for and click the AliyunRDSInstanceEncryptionRolePolicy policy that you created. This adds the policy to the Selected list on the right.

7. Click OK.

Next steps

After you create the access policy and the RAM role described above, you can enable Transparent Data Encryption (TDE) for your cluster, or enable TDE directly when you create a cluster.