Alibaba CloudOverview
Description
Enable Transparent Data Encryption on every RDS instance.
Rationale
RDS Database transparent data encryption helps protect against the threat of malicious activity by performing real-time encryption and decryption of the database, associated backups, and log files at rest without requiring changes to the application.
References
Additional Information
SQL Server 2008 R2, SQL Server 2008R2, SQL Server 2012 Enterprise Edition, SQL Server 2016 Enterprise Edition, SQL Server 2017 Enterprise Edition and MySQL 5.6/5.7/8.0 all support TDE enablement. You have to log in with an Alibaba Cloud account rather than a RAM user account. KMS should be activated. If KMS is not activated, you will be prompted to activate it when attempting to enable TDE.
Remediation guidance
Via the management console
- Open the ApsaraDB RDS instance using the
Open in Alibabamenu option - Select the
TDEtab - On the
TDEtab, findTDE Statusand click the switch next toDisabled - In the displayed dialog box, choose an automatically generated key or custom key, and click
Confirm
Encrypt a table
For RDS for MySQL, connect to the instance and run the following command to encrypt tables.
alter table <tableName> engine=innodb, block_format=encrypted
For RDS for SQL Server, click Configure TDE, select the databases to encrypt, add them to the right, and click OK.
Decrypt data
To decrypt a MySQL table encrypted by TDE, run the following command:
alter table <tableName> engine=innodb, block_format=default
To decrypt an SQL Server table encrypted by TDE, click Configure TDE and move the
database to the left.
Multiple Remediation Paths
SERVICE-WIDE (RECOMMENDED when many resources are affected): Apply organization/tenant-level guardrails and baseline policies for the entire platform.
ASSET-LEVEL: Fix only the affected resources identified by this control.
PREVENTIVE: Add preventive policy checks to CI/CD and periodic posture scans.
References for Service-Wide Patterns
- Platform policy/governance and preventive control patterns should be applied tenant-wide where supported.
Query logic
These are the stored checks tied to this control.
'TDE' is set to 'Enabled' for applicable database instances
Connectors
Covered asset types
Expected check: eq []
dbInstances(where: { tdeStatus_NOT: "Enabled" }) {...AssetFragment}
