Configuring Disk Encryption

Introduction

The RDS console provides server-side encryption with Data Encryption Workshop (DEW)-managed keys.

DEW uses a third-party hardware security module (HSM) to protect keys, enabling you to easily create and control encryption keys. For security reasons, keys are not displayed in plaintext outside of HSMs. With DEW, all operations on keys are controlled and logged, and usage records of all keys can be provided to meet regulatory compliance requirements.

If server-side encryption is enabled, disk data will be encrypted and stored on the server when you create a DB instance or expand disk capacity. When downloading encrypted objects, the encrypted data will be decrypted on the server and displayed to you in plaintext.

This section describes how to enable or modify disk encryption for primary instances and read replicas after instances are purchased.

Prerequisites

You need to first create a key using DEW or use the default key that DEW comes with. When creating a DB instance, enable disk encryption and select an existing key or create a new one as the tenant key. The key is used for server-side encryption.

• You will need the KMS administrator permission for the region where the RDS instance is deployed. This permission can be granted using Identity and Access Management (IAM). For details about how to obtain the permissions, see Creating a User Group and Assigning Permissions.
• If you want to use a custom key to encrypt objects to be uploaded, create a key using DEW. RDS supports only symmetric keys. For details, see Creating a Key.

Constraints

• The instance remains available (certain modification operations are allowed) during disk encryption, but an interruption of several minutes will occur. Perform this operation during off-peak hours.
• You can enable disk encryption only when the instance is in the Available state. Once disk encryption is enabled, it cannot be disabled later.

• After disk encryption is enabled, newly added storage is encrypted using the key you selected when enabling disk encryption.
• After disk encryption settings are modified, newly added storage is encrypted using the new key.
• You cannot configure or modify disk encryption simultaneously for a primary instance and its read replicas, nor for multiple read replicas of the same primary instance.
• Disk encryption is not supported for DR instances.
• The AES_256 and SM4 algorithms are supported.
• If a shared KMS key is used, the corresponding CTS events are createdatakey and decrydatakey. Only the key owner can receive the events.
• Keep the key secure. Once it is disabled, deleted, or frozen, your instance will be inaccessible and its data may not be restored.

  If disk encryption is enabled but backup encryption is not enabled, you can restore data to a new instance from backups.

  If both disk encryption and backup encryption are enabled, any lost data cannot be restored.

Enabling Disk Encryption

1. Log in to the RDS console.
2. Click in the upper left corner and select a region.
3. On the Instances page, click the name of the target instance or read replica to go to the Summary page. To locate the read replica, click in front of the instance.
4. In the Storage & Backup area, toggle on the Disk Encryption switch .
5. In the displayed dialog box, choose a new cryptographic algorithm, select the scheduled time, and then click OK.
   Figure 1 Enabling disk encryption
   
   • Immediate: The system enables disk encryption immediately after you submit the request.
   • During maintenance window: The system will enable disk encryption during the maintenance window you set.

6. Return to the instance list. In the navigation pane, choose Task Center and check the progress of the disk encryption task.
   • If you selected the Immediate option for the task:

     Open the Instant Tasks tab page and search for PostgreSQL instance disk encryption to view the task progress. Instant tasks cannot be canceled.

   • If you selected the During maintenance window option for the task:

     Open the Scheduled Tasks tab page and search for the instance ID to view the task progress. Scheduled tasks can be canceled.

   For more operations, see Viewing a Task.

Modifying Disk Encryption

You can change the keys for instances with disk encryption enabled.

1. Log in to the RDS console.
2. Click in the upper left corner and select a region.
3. On the Instances page, click the name of the target instance or read replica to go to the Summary page. To locate the read replica, click in front of the instance.
4. In the Storage & Backup area, choose More > Modify Disk Encryption next to Disk Encryption to change the key.
   Figure 2 Storage and backup
   

5. In the displayed dialog box, choose a new cryptographic algorithm, select the scheduled time, and then click OK.
   Figure 3 Modifying disk encryption
   
   • Immediate: The system enables disk encryption immediately after you submit the request.
   • During maintenance window: The system will enable disk encryption during the maintenance window you set.