Security Configuration

enable_security_policy

Parameter description: Specifies whether the unified audit and dynamic data masking policies take effect.

This is a SIGHUP parameter. Set it based on instructions provided in Table 1.

Value range: Boolean

on: The security policy is enabled.

off: The security policy is disabled.

Default value: off

use_elastic_search

Parameter description: Specifies whether to send unified audit logs to Elasticsearch. If enable_security_policy and this parameter are enabled, unified audit logs are sent to Elasticsearch through HTTP or HTTPS (used by default). After this parameter is enabled, ensure that the Elasticsearch service corresponding to elastic_search_ip_addr can be properly connected. Otherwise, the process fails to be started.

This parameter is a POSTMASTER parameter. Set it based on instructions provided in Table 1.

Value range: Boolean

on: Unified audit logs are sent to Elasticsearch.

off: Unified audit logs are not sent to Elasticsearch.

Default value: off

elastic_search_ip_addr

Parameter description: Specifies the IP address of the Elasticsearch system. If HTTPS is used, the format is https://ip:port:username. If HTTP is used, the format is http://ip:port. In the preceding command, ip indicates the IP address of the Elasticsearch server. port indicates the listening port for Elasticsearch HTTP communication, and the value ranges from 9200 to 9299. username indicates the username used for registering an Elasticsearch account. The initial user is elastic. If HTTPS is used, related certificates need to be configured. For details, see "Unified Auditing" in the Security Hardening Guide.

This parameter is a POSTMASTER parameter. Set it based on instructions provided in Table 1.

Value range: a string

Default value: ''

is_sysadmin

Parameter description: Specifies whether the current user is an initial user.

This is a fixed INTERNAL parameter and cannot be modified.

Value range: Boolean

on indicates that the user is an initial user.

off indicates that the user is not an initial user.

Default value: off

enable_tde

Parameter description: Specifies whether to enable the TDE function. Set this parameter to on before creating an encrypted table. If this parameter is set to off, new encrypted tables cannot be created. The created encrypted table is decrypted only when data is read and is not encrypted when the data is written.

This parameter is a POSTMASTER parameter. Set it based on instructions provided in Table 1.

Value range: Boolean

on: The TDE function is enabled.

off: The TDE function is disabled.

Default value: off

tde_cmk_id

Parameter description: Specifies the CMK ID of the database instance used by the TDE function. The ID is generated by KMS. The CMK of the database instance is used to encrypt the DEK. When the DEK needs to be decrypted, a request packet needs to be sent to KMS. The DEK ciphertext and the ID of the corresponding CMK are sent to KMS.

This is a SIGHUP parameter. Set it based on instructions provided in Table 1.

Value range: a string

Default value: ""

block_encryption_mode

Parameter description: Specifies the block encryption mode used by the aes_encrypt and aes_decrypt functions for encryption and decryption.

This parameter is a USERSET parameter. Set it based on instructions provided in Table 1.

Value range: enumerated values. Valid values are aes-128-cbc, aes-192-cbc, aes-256-cbc, aes-128-cfb1, aes-192-cfb1, aes-256-cfb1, aes-128-cfb8, aes-192-cfb8, aes-256-cfb8, aes-128-cfb128, aes-192-cfb128, aes-256-cfb128, aes-128-ofb, aes-192-ofb, and aes-256-ofb. aes indicates the encryption or decryption algorithm. 128, 192, and 256 indicate the key length (unit: bit). cbc, cfb1, cfb8, cfb128, and ofb indicate the block encryption or decryption mode.