[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[],[],null,["# Security and encryption\n\nDatabase Migration Service protects your data during and after migration. The following\nsecurity and encryption features ensure the safety of your migration:\n\n- Customer-managed encryption keys (CMEK) encrypt data at rest.\n- Encryption methods, such as SSL/TLS certificates and Private Service Connect, secure network connections between the source and destination databases.\n- Identity and Access Management (IAM) practices ensure access control.\n\nHomogeneous and heterogeneous migrations have different security options. For\nhomogeneous migrations, destination databases support CMEK natively while\nheterogeneous migrations require Database Migration Service to additionally encrypt\ndata at rest during conversion to a temporary database.\n\nLearn more in the sections that follow:\n\nSecure homogeneous migrations\n-----------------------------\n\nSelect your homogeneous migration scenario to view security and encryption\noptions that your migration supports: \n\n### MySQL to Cloud SQL for MySQL\n\n**CMEK**\n\nYou can migrate to Cloud SQL destinations where you configure CMEK to secure your data.\nFor more information, see\n[Use customer-managed encryption keys (CMEK)](/sql/docs/mysql/configure-cmek)\nin the Cloud SQL documentation.\n\n**Secure network connectivity**\n\nDatabase Migration Service supports SSL/TLS connectivity for your migration.\nYou can upload your own encryption certificates when you create the source\nconnection profile. For more information, see\n[Create a source connection profile](/database-migration/docs/mysql/create-source-connection-profile).\n\n**IAM**\n\nWith IAM, you can control access to your migration resources.\nFor more information, see\n[IAM authentication](/sql/docs/mysql/iam-authentication). \n\n### PostgreSQL to Cloud SQL for PostgreSQL\n\n**CMEK**\n\nYou can migrate to Cloud SQL destinations where you configure CMEK to secure your data.\nFor more information, see\n[Use customer-managed encryption keys (CMEK)](/sql/docs/postgres/configure-cmek) in the Cloud SQL documentation.\n\n**Secure network connectivity**\n\nDatabase Migration Service supports SSL/TLS connectivity for your migration.\nYou can upload your own encryption certificates when you create the source connection profile.\nFor more information, see\n[Create a source connection profile](/database-migration/docs/postgres/create-source-connection-profile).\n\n**IAM**\n\nWith IAM, you can control access to your migration resources. For more information see\n[IAM authentication](/sql/docs/postgres/iam-authentication). \n\n### PostgreSQL to AlloyDB for PostgreSQL\n\n**CMEK**\n\nYou can migrate to AlloyDB destinations where you configure CMEK to secure your data. For more information, see\n[About CMEK](/alloydb/docs/cmek) in the AlloyDB documentation.\n\n**Secure network connectivity**\n\nDatabase Migration Service supports SSL/TLS connectivity for your migration.\nYou can upload your own encryption certificates when you create the source connection profile.\nFor more information, see\n[Create a source connection profile](/database-migration/docs/postgresql-to-alloydb/create-source-connection-profile).\n\n**IAM**\n\nWith IAM, you can control access to your migration resources. For more information, see\n[Manage IAM authentication](/alloydb/docs/manage-iam-authn). \n\n### SQL Server to Cloud SQL for SQL Server\n\n**CMEK**\n\nYou can migrate to Cloud SQL destinations where you configure CMEK to secure your data.\nFor more information, see\n[Use customer-managed encryption keys (CMEK)](/sql/docs/sqlserver/configure-cmek)\nin the Cloud SQL documentation.\n\n**Migrate encrypted databases**\n\nDatabase Migration Service supports migrating encrypted columns. For more information, see\n[Use encrypted SQL Server backup files](/database-migration/docs/sqlserver/backup-file-encryption).\n\n**IAM**\n\nWith IAM, you can control access to your migration resources. For more information, see\n[IAM authentication](/sql/docs/sqlserver/iam-authentication)\n\nSecure heterogeneous migrations\n-------------------------------\n\nSelect your heterogeneous migration scenario to view security and encryption options that your migration supports: \n\n### Oracle to Cloud SQL for PostgreSQL\n\n**CMEK**\n\nDatabase Migration Service supports CMEK in the migration job to secure the data at rest.\nFor more information, see\n[Use customer-managed encryption keys (CMEK) for continuous migrations](/database-migration/docs/oracle-to-postgresql/cmek-for-migration-jobs).\n\n**Connectivity encryption**\n\nDatabase Migration Service supports SSL/TLS connectivity for your migration as well\nas other methods that accommodate differences in network access, such as IP\nallowlisting or using a forward SSH tunnel. For more information, see\n[Create connection profiles](/database-migration/docs/oracle-to-postgresql/create-connection-profiles).\n\n**IAM**\n\nWith IAM, you can control access to your migration resources. For more information, see\n[Access control with IAM](/database-migration/docs/oracle-to-postgresql/access-control). \n\n### Oracle to AlloyDB for PostgreSQL\n\n**CMEK**\n\nDatabase Migration Service supports CMEK in the migration job to secure the data at rest.\nFor more information, see\n[Use customer-managed encryption keys (CMEK) for continuous migrations](/database-migration/docs/oracle-to-alloydb/cmek-for-migration-jobs).\n\n**Connectivity encryption**\n\nDatabase Migration Service supports SSL/TLS connectivity for your migration as well\nas other methods that accommodate differences in network access, such as IP\nallowlisting or using a forward SSH tunnel. For more information, see\n[Create connection profiles](/database-migration/docs/oracle-to-alloydb/create-connection-profiles).\n\n**IAM**\n\nWith IAM, you can control access to your migration resources. For more information, see\n[Access control with IAM](/database-migration/docs/oracle-to-alloydb/access-control). \n\n### SQL Server to Cloud SQL for PostgreSQL\n\n**CMEK**\n\nDatabase Migration Service supports CMEK in the migration job to secure the data at rest.\nFor more information, see\n[Use customer-managed encryption keys (CMEK) for continuous migrations](/database-migration/docs/sqlserver-to-csql-pgsql/cmek-for-migration-jobs).\n\n**Connectivity encryption**\n\nDatabase Migration Service supports SSL/TLS connectivity for your migration as well\nas other methods that accommodate differences in network access, such as IP\nallowlisting or using a forward SSH tunnel. For more information, see\n[Use SSL/TLS certificates to encrypt network connections](/database-migration/docs/sqlserver-to-csql-pgsql/encrypt-connections-with-certificates).\n\n**IAM**\n\nWith IAM, you can control access to your migration resources. For more information, see\n[Access control with IAM](/database-migration/docs/sqlserver-to-csql-pgsql/access-control). \n\n### SQL Server to AlloyDB for PostgreSQL\n\n**CMEK**\n\nDatabase Migration Service supports CMEK in the migration job to secure the data at rest.\nFor more information, see\n[Use customer-managed encryption keys (CMEK) for continuous migrations](/database-migration/docs/sqlserver-to-alloydb/cmek-for-migration-jobs).\n\n**Connectivity encryption**\n\nDatabase Migration Service supports SSL/TLS connectivity for your migration as well\nas other methods that accommodate differences in network access, such as IP\nallowlisting or using a forward SSH tunnel. For more information, see\n[Use SSL/TLS certificates to encrypt network connections](/database-migration/docs/sqlserver-to-alloydb/encrypt-connections-with-certificates).\n\n**IAM**\n\nWith IAM, you can control access to your migration resources. For more information, see\n[Access control with IAM](/database-migration/docs/sqlserver-to-alloydb/access-control)."]]
