Feature Overview
Encryption at Rest protects message data persisted to the disk in CKafka instances. Once enabled, CKafka encrypts newly written data in the instance using the Key Management Service (KMS), reducing the risk of data leakage at the storage medium.
Scenarios
This requires a high level of security for message data storage.
It must meet internal enterprise security and compliance requirements.
You can use KMS-managed keys to centrally manage data encryption capabilities in the cloud.
Constraints and Limitations
Before using Encryption at Rest, you must first activate the Key Management Service (KMS). The Encryption at Rest feature is only available in regions where KMS is activated. The Encryption at Rest entry is not displayed in regions where KMS is not activated.
Encryption at Rest is supported only in versions 2.8.1_1.1.18 and above, and 3.2.3_1.0.13 and above. To use this feature, upgrade to a suitable minor version.
A CKafka instance supports only one KMS key. Once a key is enabled, it cannot be changed. Choose your key carefully based on your business requirements. If a KMS key is disabled, deleted, or experiences an authorization exception, encrypted data may become unreadable or unwritable.
Once enabled, Encryption at Rest cannot be disabled.
Enabling Encryption at Rest may incur some performance overhead. Enable it only after evaluating your business traffic and performance requirements.
Prerequisites
Before enabling Encryption at Rest, ensure that the following conditions are met:
1. The Encryption at Rest feature relies on the Key Management Service (KMS) to manage your encryption keys. Go to the KMS console to activate the service before using this feature. 2. Encryption at Rest is supported in the instance's region and version.
3. Authorization for CKafka to access KMS has been completed. If you need to use a custom key, you must have already created an available key in the KMS console.
Operation Steps
2. In the left sidebar, select Instance List. After selecting the region, click the ID of the target instance to go to the instance's basic information page.
3. Click the edit icon for Encryption at Rest, evaluate the options, and then enable the Encryption at Rest feature.
Attention:
Once enabled, Encryption at Rest cannot be disabled. The encryption and decryption processes consume additional CPU resources, which may reduce instance throughput performance. Enable it only after evaluating your business requirements.
4. Select a key source:
Cloud product default key: It is created and managed by KMS by default for cloud products, and you do not need to manually select a key.
Custom key: It uses a key created by the user in the KMS console. If you select a custom key, you must complete the authorization as prompted on the page and select the corresponding KMS key.
5. Click submit.
Related Instructions
After instance-level Encryption at Rest is enabled: New data subsequently written to existing Topics will be encrypted and stored by default. New data subsequently written to newly created Topics will also be encrypted and stored by default. Historical data written before instance-level Encryption at Rest is enabled remains in its original state and will not be re-encrypted.
The on-disk storage format may not exactly match the user's message production format, but this does not affect normal client production and consumption.
The rotation of the KMS master key is automatically performed by KMS.