Enabling or Disabling Encrypted Backup

Scenarios

TaurusDB can encrypt backups. After encrypted backup is enabled, a key is required, which is generated and managed by Data Encryption Workshop (DEW).

Prerequisites

• Using IAM role/policy-based authorization, you must have the kms:grant:create permission to enable encrypted backup. If you do not have these permissions, create a custom policy.
• Using IAM identity policy-based authorization, you must have the kms:cmk:createGrant permission to enable encrypted backup. If you do not have these permissions, create a custom identity policy.

Precautions

• Only the backups generated after backup encryption is enabled will be encrypted.
• After backup encryption is disabled, new backup files will not be encrypted for storage. Backup files created before backup encryption is disabled will not be decrypted.
• Currently, only the SM4 and AES-256 key algorithms are supported. After backup encryption is enabled, the key algorithm cannot be changed.
• The key cannot be disabled, deleted, or frozen while in use, or the encrypted backups cannot be used for restoration.
• Encrypted backups can be directly used to restore data on the management console. You do not need to manually decrypt backups.
• Once encrypted backup is enabled for your DB instance, data cannot be restored to an existing DB instance, even if encrypted backup is disabled later.
• Cross-region backup and encrypted backup cannot be both enabled.
• When encrypted backup is enabled for a DB instance, only the key of the corresponding enterprise project can be selected. To view keys in an enterprise project, see Viewing Key Details.

Enabling Encrypted Backup

1. Log in to the TaurusDB console.
2. Click in the upper left corner and select a region.
3. On the Instances page, click the instance name.
4. Choose Backups in the navigation pane and click next to Encrypted Backup.
   Figure 1 Enabling encrypted backup
   

5. In the displayed dialog box, select a key or enter a key ID.

   Only the SM4 and AES-256 key algorithms are supported.

   Figure 2 Selecting a key
   

6. Click OK.
7. Refresh the page and check whether encrypted backup is enabled.

Disabling Encrypted Backup

1. Log in to the TaurusDB console.
2. Click in the upper left corner and select a region.
3. On the Instances page, click the instance name.
4. Choose Backups in the navigation pane and click next to Encrypted Backup.
5. In the displayed dialog box, click OK.

APIs

• Enabling or Disabling Encrypted Backup
• Checking Whether Encrypted Backup Is Enabled