メインコンテンツまでスキップ

Encryption Keys Configuration

An encryption key configuration registers an AWS KMS key so a warehouse deployed on Custom Infrastructure can use it for Transparent Data Encryption (TDE), EBS encryption, or both. You create the KMS key and configure its key policy to grant VeloDB Cloud access in the AWS KMS Console, then register its ARN in the VeloDB Cloud console.

What to prepare​

Create the KMS key and enter its ARN in the encryption key configuration:

What VeloDB Cloud needsYou create in the AWS consoleYou enter in the VeloDB Cloud console
A customer-managed key for TDE, EBS encryption, or bothA symmetric KMS key with a key policy that grants VeloDB Cloud accessAWS Key ARN (arn:aws:kms:<region>:<aws-account-id>:key/<key-id>)

Before you start​

  • This procedure applies only to Custom Infrastructure warehouses on AWS.
  • Create a credential configuration before creating an encryption key configuration.
  • Create the KMS key in the same region as the warehouse. AWS KMS keys are regional, and a key in another region cannot be used and can leave deployment stalled.
  • Choose what the key encrypts. TDE only encrypts warehouse data at rest, and EBS only encrypts the cluster EBS volumes. You can change a TDE encryption key after warehouse creation. You must select an EBS encryption key during warehouse creation and cannot change it later.

Register the encryption key configuration​

You can register a key from the Cloud Resources page. You can also add one inline while creating a BYOC warehouse. For the inline workflow, see Deploy on Custom Infrastructure.

  1. On the Cloud Resources page, click Add New Configuration, then choose Encryption Key Configuration to open Add New Encryption Key Configuration.
  2. In Basic, enter an Encryption Key Configuration Name, then select the credential in Choose Credential Configuration.
  3. In Usage, choose what the key encrypts: Both TDE and EBS encryption, TDE only (encrypts warehouse data at rest), or EBS only (encrypts the cluster's EBS volumes).
  4. In Grant KMS Access, give VeloDB Cloud permission to use the key:
    • In the AWS KMS Console, create or select a customer-managed symmetric key in the warehouse region.
    • Back in the VeloDB Cloud console's Grant KMS Access step, copy the key policy statement the console generates.
    • On the KMS key's Key policy tab in AWS, add the copied statement so VeloDB Cloud can encrypt and decrypt with the key, then click Continue.
  5. In Specify Key, copy the key ARN from the AWS KMS Console, paste it into AWS Key ARN (arn:aws:kms:<region>:<aws-account-id>:key/<key-id>), then click Confirm.

Note:

The console generates the Grant KMS Access policy statement for you. Add this statement to the existing KMS key policy without removing other required statements. For the AWS Key ARN, use the full ARN from the key's page in the AWS KMS Console.

For more information, see the AWS documentation for creating KMS keys and key policies.

Verify the encryption key configuration​

The key configuration appears on the Encryption Keys Configuration tab of the Cloud Resources page after the console saves it. You can select it when you create a a warehouse deployed on Custom Infrastructure.

See also​