Encryption at rest

Create a key vault using the Azure portal. The following settings are required:

• Set the vault permission model as Vault access policy.

• Add the application to the key vault access policies with the minimum key management operations permissions of Get and Create (unless you are pre-creating the key), as well as cryptographic operations permissions of Unwrap Key and Wrap Key.

  Required permissions are as follows:

  "permissions": [ {
      "actions": [
        "Microsoft.KeyVault/vaults/keys/read",
        "Microsoft.KeyVault/vaults/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.KeyVault/vaults/keys/read",
        "Microsoft.KeyVault/vaults/keyrotationpolicies/read",
        "Microsoft.KeyVault/vaults/keys/wrap/action",
        "Microsoft.KeyVault/vaults/keys/unwrap/action"
      ],
      "notDataActions": []
  } ]
  

If you are planning to use an existing cryptographic key with the same name, it must meet the following criteria:

• The primary key version should be in the Enabled state.
• The activation date should either be disabled or set to a date before the KMS configuration creation.
• The expiration date should be disabled.
• Permitted operations should have at least WRAP_KEY and UNWRAP_KEY.
• The key rotation policy should not be defined in order to avoid automatic rotation.

In addition, you need the client ID and secret for an application registered in Azure with permission to encrypt and decrypt using the CMK. Refer to Create a new client secret in the Microsoft documentation.

For more information, refer to the Azure Key Vault documentation.

To use Cloud KMS, you need the following:

• CMK (AKA customer-managed encryption key or CMEK) created in Cloud KMS.
• Cloud KMS resource ID. You can copy the resource ID from KMS Management page in the Google Cloud console. Do not include the key version. For more information, refer to Getting a Cloud KMS resource ID in the GCP documentation.
• A service account that has been granted the following permissions on the CMK:
  • cloudkms.keyRings.get
  • cloudkms.cryptoKeys.get
  • cloudkms.cryptoKeyVersions.useToEncrypt
  • cloudkms.cryptoKeyVersions.useToDecrypt
  • cloudkms.locations.generateRandomBytes
• Service account credentials. These credentials are used to authorize your use of the CMK. This is the key file (JSON) that you downloaded when creating credentials for the service account. For more information, refer to Create credentials for a service account in the GCP documentation.

For more information on GCP KMS, refer to Cloud Key Management Service overview in the GCP documentation.

You can enable EAR using a CMK for clusters (database version 2.16.7 and later only) as follows:

1. On the cluster Settings tab, select Encryption at rest.
2. Click Enable Cluster Encryption at Rest.
3. Provide the Azure tenant ID, the vault URI (for example, https://myvault.vault.azure.net), and the name of the key.
4. Enter the client ID and secret for an application with permission to encrypt and decrypt using the CMK.

You can enable EAR using a CMK for clusters (database version 2.16.7 and later only) as follows:

1. On the cluster Settings tab, select Encryption at rest.
2. Click Enable Cluster Encryption at Rest.
3. Enter the resource ID of the key ring where the CMK is stored.
4. Click Add Key to select the credentials JSON file you downloaded when creating credentials for the service account that has permissions to encrypt and decrypt using the CMK.