Alibaba CloudOverview
Description
Enable Transparent Data Encryption on every RDS instance.
Rationale
RDS Database transparent data encryption helps protect against the threat of malicious activity by performing real-time encryption and decryption of the database, associated backups, and log files at rest without requiring changes to the application.
References
Additional Information
SQL Server 2008 R2, SQL Server 2008R2, SQL Server 2012 Enterprise Edition, SQL Server 2016 Enterprise Edition, SQL Server 2017 Enterprise Edition and MySQL 5.6/5.7/8.0 all support TDE enablement. You have to log in with an Alibaba Cloud account rather than a RAM user account. KMS should be activated. If KMS is not activated, you will be prompted to activate it when attempting to enable TDE.
Remediation guidance
Via the management console
- Open the ApsaraDB RDS instance using the
Open in Alibabamenu option - Select the
TDEtab - On the
TDEtab, findTDE Statusand click the switch next toDisabled - In the displayed dialog box, choose an automatically generated key or custom key, and click
Confirm
Encrypt a table
For RDS for MySQL, connect to the instance and run the following command to encrypt tables.
alter table <tableName> engine=innodb, block_format=encrypted
For RDS for SQL Server, click Configure TDE, select the databases to encrypt, add them to the right, and click OK.
Decrypt data
To decrypt a MySQL table encrypted by TDE, run the following command:
alter table <tableName> engine=innodb, block_format=default
To decrypt an SQL Server table encrypted by TDE, click Configure TDE and move the
database to the left.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Alibaba Cloud
Use Resource Directory guardrails, account baselines, and IaC modules so the secure setting is applied consistently across environments.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
'TDE' is set to 'Enabled' for applicable database instances
Connectors
Covered asset types
Expected check: eq []
dbInstances(where: { tdeStatus_NOT: "Enabled" }) {...AssetFragment}
