Ensure RDS instance TDE protector is encrypted with BYOK (Use your own key)

HochStufe 2Manuelle Prüfungalibaba

Beschreibung

TDE with BYOK support provides increased transparency and control, increased security with an HSM-backed KMS service, and promotion of separation of duties. With TDE, data is encrypted at rest with a symmetric key (called the database encryption key). Bring Your Own Key (BYOK) support for Transparent Data Encryption (TDE) allows user control of TDE encryption keys and restricts who can access them and when. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Using the management console: 1. Logon to RDS Console. 2. In the upper-left corner, select the region of the target instance. 3. Locate the target instance, and click the instance ID. 4. In the left-side navigation pane, click Data Security to go to the Security page. 5. Click the TDE tab. 6. Check the button TDE Status is Enabled and a custom key ID is shown for the Key field and the status is Valid.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Using the management console: 1. Logon to RDS Console. 2. In the upper-left corner, select the region of the target instance. 3. Locate the target instance, and click the instance ID to enter the Basic Information page. 4. In the left-side navigation pane, click Data Security to go to the Security page. 5. Click the TDE tab. 6. On the TDE tab, find TDE Status and click the switch next to Disabled. 7. In the displayed dialog box, choose custom key, click Confirm.

Eigenschaften

Betriebssysteme: Beliebig
Tags: alibabards
Referenz: CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 6.6 Ensure RDS instance TDE protector is encrypted with BYOK (Use your own key)