Create a column encryption rule

-- Set the TDE method to internal or obcloud.
ALTER SYSTEM SET tde_method = '<encryption_method>';
ALTER INSTANCE ROTATE INNODB MASTER KEY;	-- The first execution will take about 20 seconds for the key to take effect.

CREATE SENSITIVE RULE <rule_name> 
ON <sensitive_field_list>
USING ENCRYPTION [ = <encryption_method>];

DROP SENSITIVE RULE <rule_name>;

-- Add a sensitive column.
ALTER SENSITIVE RULE <rule_name> ADD COLUMN <sensitive_field_list>;
-- Drop a sensitive column.
ALTER SENSITIVE RULE <rule_name> DROP COLUMN <sensitive_field_list>;
-- Enable a rule.
ALTER SENSITIVE RULE <rule_name> ENABLE;
-- Disable a rule.
ALTER SENSITIVE RULE <rule_name> DISABLE;
-- Change the encryption algorithm.
ALTER SENSITIVE RULE <rule_name> USING ENCRYPTION [= <encryption_method>];

-- Create a sensitive rule named r1 to protect the a column of the tbl1 table, the b and c columns of the tbl2 table, and the e and f columns of the tbl3 table in the user2 schema.
-- If you do not specify an encryption algorithm, the default algorithm, AES-256-ECB, is used. This is equivalent to USING ENCRYPTION = 'aes-256'.
CREATE SENSITIVE RULE r1 on tbl1(a), tbl2(b, c), user2.tbl3(e,f)
USING ENCRYPTION;

-- Create a sensitive rule named r2 to protect the x and y columns of the tbl4 table and the z column of the tbl5 table.
-- Use the SM4-CBC encryption algorithm.
CREATE SENSITIVE RULE r2 on tbl4(x, y), tbl5(z)
USING ENCRYPTION = 'sm4-cbc';

DROP SENSITIVE RULE r1;

-- Add the c column of the tbl2 table and the x column of the tbl3 table in the user2 schema to the sensitive rule named r1.
ALTER SENSITIVE RULE r1 ADD COLUMN tbl2(c), user2.tbl3(x);

-- Drop the c column of the tbl2 table from the sensitive rule named r1.
ALTER SENSITIVE RULE r1 DROP COLUMN tbl2(c);

-- Enable the sensitive rule named r1.
ALTER SENSITIVE RULE r1 ENABLE;

-- Disable the sensitive rule named r1.
ALTER SENSITIVE RULE r1 DISABLE;

-- Change the encryption algorithm of the sensitive rule named r1 to the default algorithm.
ALTER SENSITIVE RULE r1 USING ENCRYPTION;

-- Change the encryption algorithm of the sensitive rule named r1 to SM4-CBC.
ALTER SENSITIVE RULE r1 USING ENCRYPTION = 'sm4-cbc';