Ensure RDS instance TDE protector is encrypted with BYOK (Use your own key)

高级别 2人工审核alibaba

说明

TDE with BYOK support provides increased transparency and control, increased security with an HSM-backed KMS service, and promotion of separation of duties. With TDE, data is encrypted at rest with a symmetric key (called the database encryption key). Bring Your Own Key (BYOK) support for Transparent Data Encryption (TDE) allows user control of TDE encryption keys and restricts who can access them and when. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Using the management console: 1. Logon to RDS Console. 2. In the upper-left corner, select the region of the target instance. 3. Locate the target instance, and click the instance ID. 4. In the left-side navigation pane, click Data Security to go to the Security page. 5. Click the TDE tab. 6. Check the button TDE Status is Enabled and a custom key ID is shown for the Key field and the status is Valid.

修复方式

修复方法: 操作指南或基础设施补丁

Using the management console: 1. Logon to RDS Console. 2. In the upper-left corner, select the region of the target instance. 3. Locate the target instance, and click the instance ID to enter the Basic Information page. 4. In the left-side navigation pane, click Data Security to go to the Security page. 5. Click the TDE tab. 6. On the TDE tab, find TDE Status and click the switch next to Disabled. 7. In the displayed dialog box, choose custom key, click Confirm.

属性

操作系统: 任意
标签: alibabards
参考: CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 6.6 Ensure RDS instance TDE protector is encrypted with BYOK (Use your own key)