PolarDB:Configure TDE

Overview

Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption on data files. It encrypts data before writing to disk and decrypts it when reading from disk into memory. TDE does not increase the size of data files, and you can use this feature without changing any application code.

Key Management Service (KMS) generates and manages the encryption keys. PolarDB-X does not provide the keys or certificates required for encryption. PolarDB-X supports keys that are automatically generated by Alibaba Cloud. Alternatively, you can use your own key materials to create a custom key and then authorize PolarDB-X to use it.

Prerequisites

KMS must be activated. If it is not, you can follow the on-screen instructions to activate it when you enable TDE.

Procedure

1. Log in to the PolarDB Distributed Edition console.
2. In the upper-left corner of the page, select the region of your target instance.
3. On the instance list page, click the PolarDB-X 2.0 tab.
4. Find the target instance and click its instance ID.
5. In the left-side navigation pane, choose Configuration and Management > Security Management.
6. On the TDE tab, click the switch next to the Disabled status.
7. In the Set TDE dialog box, choose one of the following options:
   • Select Use Automatically Generated Key and click OK to enable TDE.
   • Select Use Existing Custom Key, select a key, and then click OK to enable TDE.
     Note If you do not have a custom key, click Create Now to open the KMS console. In the console, you can create a key and import your own key materials. For more information, see Key Management Service.

Encryption

Log in to the database and run the following command to encrypt an existing table:

alter table <tablename> encryption='Y';

To create an encrypted table directly, run the following command:

create table <tablename> <col definition> ENCRYPTION='Y';

Decryption

Log in to the database and run the following command to decrypt an encrypted table:

alter table <tablename> ENCRYPTION='N';