Skip to main content

Warehouse Encryption

Premium plan feature

Customer-managed keys for TDE and EBS encryption require the Premium plan. To upgrade, see Plans.

VeloDB Cloud protects warehouse data at rest through storage-layer encryption and, optionally, warehouse-layer encryption.

Encryption layerWhat it protectsHow it is applied
Transparent Data Encryption (TDE)Warehouse service data before it is written to storage.Optional warehouse-layer encryption for AWS warehouses.
EBS encryptionEBS volumes used by warehouse nodes, including cache-related block storage.Supported for AWS BYOC warehouses created with the Custom Infrastructure option.
S3 encryptionWarehouse data stored in Amazon S3.Enabled through S3 server-side encryption. Customer-managed keys require the Custom Infrastructure option.
note

Transparent Data Encryption (TDE) is currently supported only for AWS warehouses. EBS encryption is currently supported only for AWS BYOC warehouses. To enable the encryption key, choose the Custom Infrastructure option when creating the warehouse, which is available only on AWS. The TDE key can be rotated at any time after it is added. The EBS key can only be set at warehouse creation and cannot be rotated afterward.

Transparent Data Encryption​

Enable Transparent Data Encryption (TDE) to add an extra layer of protection for service data, or supply your own key to implement Customer Managed Keys (CMK). Enhanced encryption is available for AWS warehouses.

enable-tde

Key management options​

VeloDB Cloud supports two key management modes for TDE:

ModeHow it worksWhen to use
VeloDB-managed keyAfter enabling TDE, VeloDB Cloud uses the cloud provider's key by default. No additional configuration required.Default. Suitable for most workloads.
Customer-managed keyYou provide an AWS KMS key. VeloDB Cloud uses it to encrypt and decrypt data but never stores or exports it.Required for compliance programs (SOC 2, HIPAA, PCI DSS) that mandate customer key ownership, or when you need the ability to revoke VeloDB's access to your data by disabling or deleting the key.

Both modes provide warehouse-layer encryption at rest. The difference is who controls the key lifecycle.

Use a customer-managed KMS key​

After enabling TDE, you can rotate from a VeloDB-managed key to your own AWS KMS key at any time.

tde-settings

  1. Create a KMS key. In the AWS KMS console, create a new symmetric encryption key. Note the Key ARN, you will need it in step 4.

  2. Copy the Encryption Role ID. In the VeloDB Cloud console, open Settings, click Rotate KMS, and copy the Encryption Role ID.

    tde-rotate-key

  3. Update the key policy. Add the following statement to the KMS key policy. Replace <Encryption Role ID> with the value copied in the previous step.

    {
        "Sid": "Allow VeloDB Access",
        "Effect": "Allow",
        "Principal": {
            "AWS": [ "<Encryption Role ID>" ]
        },
        "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncrypt*",
            "kms:DescribeKey"
        ],
        "Resource": "*"
    }

  4. Apply the key. Return to VeloDB Cloud, paste the Key ARN into the Transparent Data Encryption section of Settings, and click Rotate.

Warning Do not disable or delete the KMS key after applying it. VeloDB Cloud requires continuous access to the key to operate the warehouse. Losing access makes the warehouse unavailable and its data unreadable.

Key rotation​

To rotate the key material, create a new KMS key and repeat the steps above. VeloDB Cloud re-encrypts the data encryption key automatically without downtime.

Audit​

AWS KMS logs every use of your key in AWS CloudTrail, giving you a full audit trail of encryption and decryption operations.

EBS encryption​

EBS encryption protects the block storage volumes used by warehouse nodes, including cache-related storage. It helps prevent data from being read directly from the underlying EBS volumes.

For SaaS warehouses, EBS encryption is managed by VeloDB Cloud and enabled by default.

For BYOC warehouses created with the Custom Infrastructure option, you can configure the EBS key when creating the warehouse. In the warehouse creation flow, open Advanced Settings and specify the EBS key that should be used for the warehouse's EBS volumes. The EBS key can only be set at creation time and cannot be rotated afterward.

S3 bucket encryption​

S3 bucket encryption protects warehouse data stored in Amazon S3. It uses S3 server-side encryption to help prevent data from being read directly from the underlying bucket.

For SaaS warehouses, S3 bucket encryption is managed by VeloDB Cloud and enabled by default. You do not need to configure or manage the underlying bucket encryption settings.

For BYOC warehouses, the bucket is encrypted by default with keys managed by the cloud provider. To encrypt the bucket with your own customer-managed key, create the warehouse with the Custom Infrastructure option and provide a bucket configured with that key. The New VPC and Existing VPC template flows create the bucket for you and use cloud-provider-managed keys.