Tablestore:Data encryption

KMS CMK-based encryption

When you use KMS CMK-based encryption, you do not need to purchase or create a KMS instance. You only need to turn on the Encryption switch and select CMK of KMS for the Encryption Type parameter when you create a data table in the Tablestore console.

1. Log on to the Tablestore console.

2. At the top of the page, select a region.

3. On the Overview page, click the name of the instance that you want to manage or click Manage Instance in the Actions column of the instance.

4. On the Instance Details tab, click Create Table.

5. In the Create Table dialog box, configure the parameters.

   1. Enter a table name and configure the primary key.

   2. Turn on the Encryption switch and select CMK of KMS for the Encryption Type parameter.

      

6. Click Create.

After the table is created, you can check whether the data encryption feature is enabled by performing the following operations: Click the name of the data table and check whether the value of the Encryption field in the Description section of the Basic Information tab is Yes-CMK of KMS.

BYOK-based encryption

To use BYOK-based encryption, you must obtain the key ID and RAM role ARN before you create a data table.

1. Key ID: Tablestore uses this key to encrypt and decrypt data.

   1. Log on to the KMS console.

   2. Click Keys in the left navigation pane, select a key from the key list, and copy the key ID. You can also create a new software-protected key. For more information, see Manage keys.

      

2. RAM role ARN: Tablestore calls KMS to encrypt and decrypt data by assuming a RAM role. You must create a RAM role and grant permissions to the RAM role.

   1. Create a RAM role.

      1. Log on to the RAM console.

      2. Choose Identities > Roles. On the Roles page, click Create Role.

      3. Select Cloud Service for the Principal Type parameter, and Tablestore / OTS for the Principal Name parameter. Click OK.

         

      4. In the Create Role dialog box, enter a role name in the Role Name field, such as TablestoreBYOK, and click OK. Follow the on-screen instructions to complete verification and create the role.

   2. Create a custom policy.

      1. Log on to the RAM console.

      2. Choose Permissions > Policies. On the Policies page, click Create Policy.

      3. Select the JSON tab, enter the following script content, and click OK.

         {
             "Version": "1",
             "Statement": [
                 {
                     "Effect": "Allow",
                     "Action": [
                         "kms:Decrypt",
                         "kms:GenerateDataKey"
                     ],
                     "Resource": [
                         "*"
                     ]
                 }
             ]
         }

      4. In the Create Policy dialog box, enter a policy name in the Policy Name field, such as TablestoreBYOKPolicy, and click OK.

   3. Attach the custom policy to the RAM role.

      1. Log on to the RAM console.

      2. Choose Identities > Roles, and click Grant Permission in the Actions column of the RAM role.

      3. In the Grant Permission panel, enter the policy name to search in the Policy section, select the custom policy, and click Grant permissions to attach the custom policy to the RAM role.

         

   4. Obtain the ARN of the RAM role.

      1. Log on to the RAM console.

      2. Choose Identities > Roles. On the Roles page, click the name of the role.

      3. Copy the ARN of the RAM role in the Basic Information section.

         

After you obtain the key ID and RAM role ARN, you can create a data table encrypted by using the BYOK-based encryption method in the Tablestore console.

1. Log on to the Tablestore console.

2. At the top of the page, select a region.

3. On the Overview page, click the name of the instance or click Manage Instance in the Actions column of the instance.

4. On the Instance Details tab, click Create Table.

5. In the Create Table dialog box, configure the parameters.

   1. Enter a table name and configure the primary key.

   2. Turn on the Encryption switch, select BYOK-based Key for the Encryption Type parameter, and enter the key ID and RAM role ARN.

      

6. Click Create.

After the table is created, you can check whether the data encryption feature is enabled by performing the following operations: Click the name of the data table and check whether the value of the Encryption field in the Description section of the Basic Information tab is Yes-BYOK-based Key.