Back to Checks
alibabacloud

RDS instance TDE uses a customer-managed key (BYOK)

rds_instance_tde_key_custom
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:ALIYUN::RDS::DBInstance

Alibaba Cloud RDS instances with TDE enabled should use a customer-managed key (BYOK) rather than a service-managed key. BYOK provides increased transparency and control over the encryption key lifecycle, enhanced security through an HSM-backed KMS service, and promotes separation of duties between the data owner and the cloud provider.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Using service-managed keys means the cloud provider manages the encryption keys, limiting the data owner's control over key access and rotation. Without BYOK (Bring Your Own Key), the cloud provider retains the ability to access encrypted data, reducing confidentiality assurance and making it harder to enforce separation of duties and key lifecycle management policies.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks rds_instance_tde_key_custom

Recommendation

Configure TDE on RDS instances to use a customer-managed key (BYOK) from KMS for full control over the encryption key lifecycle and enhanced security.

Remediation

CLI

aliyun rds ModifyDBInstanceTDE --DBInstanceId <instance_id> --TDEStatus Enabled --EncryptionKey <kms_key_id>

Terraform

resource "alicloud_db_instance" "example" {
  engine           = "MySQL"
  engine_version   = "8.0"
  instance_type    = "rds.mysql.s1.small"
  instance_storage = 20
  tde_status       = "Enabled"
  encryption_key   = alicloud_kms_key.example.id
}

Other

1Log on to the **RDS Console**.
2Select the target RDS instance.
3Go to **Data Security** > **TDE** tab.
4Click the switch next to **Disabled** (or modify existing TDE configuration).
5In the displayed dialog box, choose **custom key** and select your KMS key.
6Click **Confirm**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.rds.rds_client import rds_client


class rds_instance_tde_key_custom(Check):
    """Check if RDS instance TDE protector is encrypted with BYOK."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for instance in rds_client.instances:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=instance
            )
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"acs:rds:{instance.region}:{rds_client.audited_account}:dbinstance/{instance.id}"

            # TDE must be enabled AND key must be custom (not service managed)
            # Note: The API response for TDEKeyId usually indicates if it's a custom KMS key
            # If it's a UUID-like string, it's likely a KMS key. If it's "ServiceManaged" or similar, it's not.
            # For Alibaba Cloud, typically if you supply a KeyId it's BYOK.

            if instance.tde_status == "Enabled" and instance.tde_key_id:
                report.status = "PASS"
                report.status_extended = f"RDS Instance {instance.name} has TDE enabled with custom key {instance.tde_key_id}."
            elif instance.tde_status == "Enabled":
                report.status = "FAIL"
                report.status_extended = f"RDS Instance {instance.name} has TDE enabled but uses service-managed key."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"RDS Instance {instance.name} does not have TDE enabled."
                )

            findings.append(report)

        return findings

References