Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Database Migration Service sepenuhnya kompatibel dengan cadangan SQL Server yang dienkripsi. Anda dapat mengupload
kunci enkripsi ke Google Cloud sehingga Database Migration Service dapat mendekripsi
data Anda dengan aman dan memuat data tersebut ke instance tujuan Cloud SQL untuk SQL Server tanpa
mempertaruhkan keamanan data Anda.
Jika ingin menggunakan file cadangan terenkripsi, Anda harus mengenkripsi setiap file cadangan
(penuh, diferensial, log transaksi) yang Anda gunakan untuk database tertentu yang disertakan
dalam migrasi. Artinya, jika ingin mengenkripsi file pencadangan penuh, Anda juga harus mengenkripsi file pencadangan diferensial dan file log transaksi yang Anda gunakan untuk database tersebut. Semua file cadangan harus dienkripsi dengan kunci
yang sama.
Enkripsi cadangan dievaluasi per database. Misalnya, jika Anda memigrasikan
dua database dari instance SQL Server sumber: my-business-database
dan my-other-database, Anda dapat menggunakan cadangan terenkripsi secara terpisah untuk
my-business-database, atau my-other-database, atau kedua database.
Untuk menggunakan pencadangan terenkripsi untuk migrasi Anda, lakukan langkah-langkah berikut:
Buat cadangan instance SQL Server sumber Anda dan gunakan
fitur enkripsi. Simpan kunci enkripsi Anda di lokasi yang aman untuk
menguploadnya nanti ke Cloud Storage. Lihat
Enkripsi cadangan dalam dokumentasi Microsoft.
Khusus Google Cloud CLI: Buat file pemetaan dalam format JSON untuk mencocokkan kunci enkripsi dengan database relevannya yang disertakan dalam tugas migrasi Anda.
File pemetaan adalah array objek yang masing-masing mewakili pemetaan untuk
satu database. Contoh file konfigurasi:
[{"database":"db1","encryptionOptions":{"certPath":"Path to certificate 1","pvkPath":"Path to certificate private key 1","pvkPassword":"Private key password 1"}},{"database":"db2","encryptionOptions":{"certPath":"Path to certificate 2","pvkPath":"Path to certificate private key 2","pvkPassword":"Private key password 2"}}]
certPath, pvkPath, dan pvkPassword adalah jalur Cloud Storage
ke file sertifikat dalam format gs://BUCKET_NAME/OBJECT_NAME.
Contoh: gs://my-bucket-name/certificate-folder/certificate-key-file1.
Untuk mengetahui informasi selengkapnya, lihat Namespace objek dalam dokumentasi Cloud Storage.
Saat Anda membuat lebih banyak file cadangan (file cadangan diferensial atau file log transaksi), pastikan Anda mengenkripsinya dengan kunci enkripsi yang sama dengan yang Anda gunakan untuk pencadangan penuh.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[[["\u003cp\u003eDatabase Migration Service supports encrypted SQL Server backups, allowing secure data transfer to Cloud SQL by decrypting data using user-provided encryption keys.\u003c/p\u003e\n"],["\u003cp\u003eIf encrypting backups, all backup files (full, differential, transaction log) for a specific database must be encrypted using the same key.\u003c/p\u003e\n"],["\u003cp\u003eEncryption can be applied independently per database during migration, offering flexibility in securing different databases.\u003c/p\u003e\n"],["\u003cp\u003eTo use encrypted backups, users must first encrypt backups on their source SQL Server, upload encryption keys to Cloud Storage, and then map the keys to the respective databases during migration setup.\u003c/p\u003e\n"],["\u003cp\u003eWhen creating additional backup files, they must also be encrypted with the same key used for the initial full backup.\u003c/p\u003e\n"]]],[],null,["# Use encrypted SQL Server backup files\n\nDatabase Migration Service is fully compatible with encrypted\nSQL Server backups. You can upload your\nencryption key to Google Cloud so that Database Migration Service can safely decrypt\nyour data and load it to the Cloud SQL for SQL Server destination instance without\ncompromising your data security.\n\nIf you want to use encrypted backup files, you must encrypt **every backup file**\n(full, differential, transaction log) you use for a specific database included\nin your migration. That is, if you want to encrypt your full backup file, then\nyou must also encrypt the differential backup file and the transaction log files\nyou use for that database. All backup files must be encrypted with the same\nkey.\n\nBackup encryption is evaluated per database. For example, if you migrate\ntwo databases from your source SQL Server instance: `my-business-database`\nand `my-other-database`, you can use encrypted backups independently for\n`my-business-database`, or `my-other-database`, or both databases.\n\nTo use encrypted backups for your migration, perform the following steps:\n\n1. Take the backup of your source SQL Server instance and use\n the encryption features. Save your encryption keys in a safe location to\n upload them later to Cloud Storage. See\n [Backup encryption](https://learn.microsoft.com/en-us/sql/relational-databases/backup-restore/backup-encryption) in Microsoft documentation.\n\n2. [Upload the encryption keys](/storage/docs/uploading-objects)\n to a Cloud Storage bucket.\n\n3. **Google Cloud CLI only**: Create a mapping file in the JSON format to match\n the encryption keys with their relevant databases included in your migration job.\n The mapping file is an array of objects that each represent mappings for\n a single database. Example configuration file:\n\n [\n {\n \"database\": \"db1\",\n \"encryptionOptions\": {\n \"certPath\": \"Path to certificate 1\",\n \"pvkPath\": \"Path to certificate private key 1\",\n \"pvkPassword\": \"Private key password 1\"\n }\n },\n {\n \"database\": \"db2\",\n \"encryptionOptions\": {\n \"certPath\": \"Path to certificate 2\",\n \"pvkPath\": \"Path to certificate private key 2\",\n \"pvkPassword\": \"Private key password 2\"\n }\n }\n ]\n\n Where:\n - `database` is your database identifier. That identifier must match the [database folder names in your Cloud Storage](/database-migration/docs/sqlserver/storage-buckets).\n - `certPath`, `pvkPath` and `pvkPassword` are Cloud Storage paths to the certificate files in the format `gs://BUCKET_NAME/OBJECT_NAME`. For example: `gs://my-bucket-name/certificate-folder/certificate-key-file1`. For more information, see [Object namespaces](/storage/docs/objects#namespace) in the Cloud Storage documentation.\n4. Provide the Cloud Storage paths to your encryption keys when you\n [create the migration job](/database-migration/docs/sqlserver/create-migration-job).\n\n5. When you create more backup files (the differential backup file or transaction\n log files), make sure you encrypt then with the same encryption key you used\n for the full backup."]]
