Skip to main content

Warehouse Encryption

Note:

Customer-managed keys for TDE and EBS encryption require the Premium plan. To upgrade, see Plans.

VeloDB Cloud protects warehouse data at rest through storage-layer encryption and, optionally, warehouse-layer encryption.

Encryption by deployment model​

The following table compares how encryption is configured for SaaS and BYOC warehouses.

Encryption targetWhat it protectsSaaSBYOC
Warehouse data (Transparent Data Encryption (TDE))Warehouse service data before it is written to storage.TDE is optional. It uses a VeloDB Cloud-managed key by default. You can rotate to a customer-managed AWS KMS key.TDE requires a customer-managed AWS KMS key because a VeloDB Cloud-managed key is not available in your cloud provider's account.
Amazon S3Warehouse data stored in Amazon S3.VeloDB Cloud creates the bucket. Encryption uses a cloud-provider-managed key.You create the bucket in your cloud provider's account and define its encryption policy.
Amazon EBSAmazon EBS volumes used by warehouse nodes, including cache-related block storage.VeloDB Cloud creates the volumes. Encryption is enabled by default with a cloud-provider-managed key.VeloDB Cloud creates the volumes in your cloud provider's account. Encryption uses a cloud-provider-managed key by default. With AWS Custom Infrastructure, you can provide a customer-managed key when you create the warehouse.

TDE​

TDE is currently supported only for AWS warehouses. On AWS, TDE adds a warehouse-layer encryption layer for service data before it is written to storage. Enable TDE when you create the warehouse.

The behavior of TDE differs between SaaS and BYOC warehouses:

  • SaaS warehouses can use a VeloDB Cloud-managed key (default) or a customer-managed AWS KMS key. After enabling TDE, you can rotate from a VeloDB Cloud-managed key to your own AWS KMS key at any time.

  • BYOC warehouses require a customer-managed AWS KMS key. If you configure a customer-managed EBS key, you must select it when you create the warehouse, and you cannot change it later.

Key management options​

VeloDB Cloud supports two key management modes for TDE:

ModeHow it worksWhen to use
VeloDB Cloud-managed keyVeloDB Cloud manages the key after you enable TDE. No additional configuration is required.Default. Suitable when you do not need to manage the key lifecycle.
Customer-managed keyYou provide a symmetric AWS KMS key and grant VeloDB Cloud permission to use it, but VeloDB Cloud never stores or exports it.Required for compliance programs (SOC 2, HIPAA, and PCI DSS) that mandate customer key ownership, or when you need the ability to revoke VeloDB Cloud's access to your data by disabling or deleting the key.

Both modes provide warehouse-layer encryption at rest. The difference is who controls the key lifecycle.

Configure a customer-managed KMS key​

After enabling TDE, you can rotate from a VeloDB Cloud-managed key to your own AWS KMS key at any time.

  1. Log in to the VeloDB Cloud console.

  2. In the upper-left corner, select the warehouse that you want to use.

  3. In the left navigation pane, under MORE, click Warehouse Settings.

  4. In the Transparent Data Encryption section, click Rotate KMS, then copy the Encryption Role ID.

  5. In the AWS KMS console, create a symmetric encryption key. Copy its Key ARN. You need it in step 7.

  6. Update the key policy. Add the following statement to the KMS key policy. Replace <Encryption Role ID> with the value copied in the previous step.

    {
        "Sid": "Allow VeloDB Access",
        "Effect": "Allow",
        "Principal": {
            "AWS": [ "<Encryption Role ID>" ]
        },
        "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncrypt*",
            "kms:DescribeKey"
        ],
        "Resource": "*"
    }

  7. Apply the key. Return to VeloDB Cloud, paste the Key ARN into the Transparent Data Encryption section of Warehouse Settings, then click Rotate.

For more information, see the AWS documentation for creating KMS keys and key policies.

Warning:

Do not disable or delete the KMS key after applying it. VeloDB Cloud requires continuous access to the key to operate the warehouse. Losing access makes the warehouse unavailable and its data unreadable.

Rotate a customer-managed TDE key​

To replace a customer-managed TDE key, create or select another KMS key and repeat the preceding steps. VeloDB Cloud re-encrypts the data encryption key automatically.

Audit key usage​

Use AWS CloudTrail to audit AWS KMS API activity for your key.

EBS encryption​

Amazon EBS encryption protects the block storage volumes used by warehouse nodes, including cache-related storage. It helps prevent data from being read directly from the underlying EBS volumes.

For a SaaS warehouse, EBS encryption is managed by VeloDB Cloud and enabled by default.

For an AWS BYOC warehouse, you can use a customer-managed EBS key only with Custom Infrastructure. Register an encryption key configuration, then select it during warehouse creation. You must select the EBS key at creation time, and you cannot change it later.

S3 bucket encryption​

Amazon S3 encryption protects warehouse data stored in Amazon S3. It uses S3 server-side encryption to help prevent data from being read directly from the underlying bucket.

For SaaS warehouses, VeloDB Cloud creates the S3 bucket and encryption uses a cloud-provider-managed key.

For BYOC warehouses, you create the bucket in your cloud provider's account and specify its encryption policy.

See also​