All Products
Search
Document Center

ApsaraDB RDS:Use the cloud disk encryption feature

Last Updated:Feb 23, 2024

ApsaraDB RDS for SQL Server provides the cloud disk encryption feature free of charge. You can enable this feature when you create an ApsaraDB RDS for SQL Server instance. The feature encrypts data on each data disk of your RDS instance based on block storage. The snapshots that are generated for the RDS instance and the cloud disks of the RDS instances that are created from those snapshots are automatically encrypted. This way, snapshot backups cannot be decrypted even if they are leaked. Cloud disk encryption ensures the security of your data. If you enable this feature, your workloads are not affected, and you do not need to modify the code of your application.

Prerequisites

  • The cloud disk encryption feature is enabled. The cloud disk encryption feature can be enabled for your RDS instance only when you create the RDS instance. For more information, see Create an ApsaraDB RDS for SQL Server instance.

  • The storage type and instance type of the RDS instance meet the following requirements:

    • The RDS instance uses the standard SSD, enhanced SSD (ESSD), or general ESSD storage type.

    • The RDS instance belongs to the general-purpose or dedicated instance family. The shared instance family is not supported.

      Note

      Serverless RDS instances do not support the cloud disk encryption feature.

Billing rules

The cloud disk encryption feature is provided free of charge. You do not need to pay additional fees for the read and write operations that you perform on the encrypted disks.

Usage notes

  • Cross-region backups are not supported for RDS instances for which the cloud disk encryption feature is enabled. For more information, see Enable the cross-region backup feature for an ApsaraDB RDS for SQL Server instance.

  • If your Key Management Service (KMS) is overdue, the standard SSDs or ESSDs of your RDS instance become unavailable. Make sure that your KMS is normal. For more information, see What is KMS?

  • If you disable or delete the customer master key (CMK) that is used for cloud disk encryption, your RDS instance cannot run as normal. For example, you cannot create snapshots, restore data from snapshots, or rebuild the secondary RDS instance of your RDS instance.

  • If your RDS instance uses a general-purpose instance type, you can use only a service key to encrypt the cloud disks of the RDS instance. If your RDS instance uses a dedicated instance type, you can use a service key or a CMK to encrypt the cloud disks of the RDS instance. For more information, see [Product changes/Feature changes] The cloud disk encryption feature of ApsaraDB RDS is adjusted from January 15, 2024.

Enable the cloud disk encryption feature for an RDS instance

When you create an RDS instance, select the standard SSD, ESSD, or general ESSD storage type, select Disk Encryption, and then specify a key. For more information, see Create an ApsaraDB RDS for SQL Server instance.

Note

For more information about how to create a key, see Purchase and enable a KMS instance.

image

View the status of the cloud disk encryption feature and key details

  1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
  2. On the Basic Information page of the RDS instance, view the key of the RDS instance that uses cloud disks.

    Note
    • If the key is not displayed on the Basic Information page, the cloud disk encryption feature is disabled for the RDS instance during instance creation.

    • The cloud disk encryption feature can be enabled for your RDS instance only when you create the RDS instance. For more information, see Create an ApsaraDB RDS for SQL Server instance.

Related operations

  • You call the CreateDBInstance operation to enable the cloud disk feature when you create an instance. For more information, see CreateDBInstance.

  • You can call the DescribeDBInstanceEncryptionKey operation to query whether the cloud disk encryption feature is enabled for an instance and the key details. For more information, see DescribeDBInstanceEncryptionKey.