Skip to main content

Encryption Keys Configuration

An Encryption key configuration registers one of your AWS KMS keys so a Custom Infrastructure warehouse can use it for Transparent Data Encryption (TDE), EBS encryption, or both. This configuration applies only to the Custom Infrastructure option. Add one from Add New Configuration on the Cloud Resources page, or inline while creating the warehouse.

To add an encryption key configuration:

  1. Basic: enter an Encryption Key Configuration Name, then in Choose Credential Configuration select the credential the key belongs to.
  2. Usage: choose what the key encrypts: Both TDE and EBS encryption, TDE only (encrypts warehouse data at rest), or EBS only (encrypts the cluster EBS volumes). TDE encryption keys can be changed after warehouse creation, while EBS encryption keys are fixed at creation and cannot be changed later.
  3. Grant KMS Access: create or choose a customer-managed symmetric key in AWS KMS, then copy the KMS policy the console shows and add it to the key's key policy so VeloDB Cloud can encrypt and decrypt with it.
  4. Specify Key: enter the AWS Key ARN (arn:aws:kms:<region>:<aws-account-id>:key/<key-id>), then click Confirm.
note

The console generates the Grant KMS Access policy for you, so you can paste it into your KMS key policy as-is. For the AWS Key ARN, substitute your own values: replace <region>, <aws-account-id>, and <key-id> with the region, account ID, and key ID of your KMS key, or copy the full ARN from the key's page in the AWS KMS console.

For how these keys are selected during warehouse creation, see Warehouse Encryption.