Skip to main content

Warehouse Encryption

Premium plan feature

Customer-managed keys for TDE and EBS encryption require the Premium plan. To upgrade, see Plans.

VeloDB Cloud protects warehouse data at rest through storage-layer encryption and, optionally, warehouse-layer encryption.

Encryption layerWhat it protectsHow it is applied
Transparent Data Encryption (TDE)Warehouse service data before it is written to storage.Optional warehouse-layer encryption for AWS warehouses.
EBS encryptionEBS volumes used by warehouse nodes, including cache-related block storage.Supported for AWS BYOC warehouses in Customer Infrastructure mode.
S3 encryptionWarehouse data stored in Amazon S3.Enabled through S3 server-side encryption.
note

Transparent Data Encryption (TDE) is currently supported only for AWS warehouses. EBS encryption is currently supported only for AWS BYOC warehouses in Customer Infrastructure mode.

Transparent Data Encryption​

Enable Transparent Data Encryption (TDE) to add an extra layer of protection for service data, or supply your own key to implement Customer Managed Keys (CMK). Enhanced encryption is available for AWS warehouses.

enable-tde

Key management options​

VeloDB Cloud supports two key management modes for TDE:

ModeHow it worksWhen to use
VeloDB-managed keyAfter enabling TDE, VeloDB Cloud uses the cloud provider's key by default. No additional configuration required.Default. Suitable for most workloads.
Customer-managed keyYou provide an AWS KMS key. VeloDB Cloud uses it to encrypt and decrypt data but never stores or exports it.Required for compliance programs (SOC 2, HIPAA, PCI DSS) that mandate customer key ownership, or when you need the ability to revoke VeloDB's access to your data by disabling or deleting the key.

Both modes provide warehouse-layer encryption at rest. The difference is who controls the key lifecycle.

Use a customer-managed KMS key​

After enabling TDE, you can rotate from a VeloDB-managed key to your own AWS KMS key at any time.

tde-settings

  1. Create a KMS key. In the AWS KMS console, create a new symmetric encryption key. Note the Key ARN, you will need it in step 4.

  2. Copy the Encryption Role ID. In the VeloDB Cloud console, open Settings, click Rotate KMS, and copy the Encryption Role ID.

    tde-rotate-key

  3. Update the key policy. Add the following statement to the KMS key policy. Replace <Encryption Role ID> with the value copied in the previous step.

    {
        "Sid": "Allow VeloDB Access",
        "Effect": "Allow",
        "Principal": {
            "AWS": [ "<Encryption Role ID>" ]
        },
        "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncrypt*",
            "kms:DescribeKey"
        ],
        "Resource": "*"
    }

  4. Apply the key. Return to VeloDB Cloud, paste the Key ARN into the Transparent Data Encryption section of Settings, and click Rotate.

Warning Do not disable or delete the KMS key after applying it. VeloDB Cloud requires continuous access to the key to operate the warehouse. Losing access makes the warehouse unavailable and its data unreadable.

Key rotation​

To rotate the key material, create a new KMS key and repeat the steps above. VeloDB Cloud re-encrypts the data encryption key automatically without downtime.

Audit​

AWS KMS logs every use of your key in AWS CloudTrail, giving you a full audit trail of encryption and decryption operations.

EBS encryption​

EBS encryption protects the block storage volumes used by warehouse nodes, including cache-related storage. It helps prevent data from being read directly from the underlying EBS volumes.

For SaaS warehouses, EBS encryption is managed by VeloDB Cloud and enabled by default.

For BYOC warehouses in Customer Infrastructure Mode, you can configure the EBS key when creating the warehouse. In the warehouse creation flow, open Advanced Encryption Settings and specify the EBS key that should be used for the warehouse's EBS volumes.

S3 bucket encryption​

S3 bucket encryption protects warehouse data stored in Amazon S3. It uses S3 server-side encryption to help prevent data from being read directly from the underlying bucket.

For SaaS warehouses, S3 bucket encryption is managed by VeloDB Cloud and enabled by default. You do not need to configure or manage the underlying bucket encryption settings.

For BYOC warehouses, warehouse data is stored in the S3 bucket configured for the warehouse in your AWS account. Keep server-side encryption enabled for this bucket.