Project: YugabyteDB (App Definition and Development / Database)
File: managed-ear.md

title: Encryption at rest linkTitle: Encryption at rest description: YugabyteDB Managed cluster encryption at rest. headcontent: Encrypt your YugabyteDB cluster earlyAccess: /preview/releases/versioning/#feature-availability menu: preview_yugabyte-cloud: identifier: managed-ear parent: cloud-secure-clusters weight: 460 type: docs For added security, you can encrypt your clusters (including backups) using a customer managed key (CMK) residing in a cloud provider Key Management Service (KMS). You grant YugabyteDB Managed access to the key with the requisite permissions to perform cryptographic operations using the key to secure the databases in your clusters. You can enable YugabyteDB EAR for a cluster as follows: On the Security page of the Create Cluster wizard when you . On the cluster Settings tab under Encryption at rest (database version 2.16.7 and later only). Note that, regardless of whether you enable YugabyteDB EAR for a cluster, YugabyteDB Managed uses volume encryption for all data at rest, including your account data, your clusters, and their backups. Data is AES-256 encrypted using native cloud provider technologies - S3 and EBS volume encryption for AWS, Azure disk encryption, and server-side and persistent disk encryption for GCP. Volume encryption keys are managed by the cloud provider and anchored by hardware security appliances. You can't enable cluster EAR on clusters with YugabyteDB versions earlier than 2.16.7. Enabling EAR can impact cluster performance. You should monitor your workload after enabling this feature. {{< tabpane text=true >}} {{% tab header="AWS" lang="aws" %}} To use AWS KMS, you need the following: Single-region created in AWS KMS. The key resource policy should include the following : kms:Encrypt kms:Decrypt kms:GenerateDataKeyWithoutPlaintext kms:DescribeKey kms:ListAliases Amazon Resource Name (ARN) of the CMK. For more information, refer to in the AWS documentation. An access key for an with permission to encrypt and decrypt using the CMK. An access key consists of an access key ID and the secret access key. For more information, refer to in the AWS documentation. For more information on AWS KMS, refer to in the AWS documentation. {{% /tab %}} {{% tab header="Azure" lang="azure" %}} Create a key vault using the . The following settings are required: Set the vault permission model as Vault access policy. Add the application to the key vault access policies with the minimum key management operations permissions of Get and Create (unless you are pre-creating the key), as well as cryptographic operations permissions of Unwrap Key and Wrap

Required permissions are as follows: ```json "permissions": [ { "actions": [ "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/read" ], "notActions": [], "dataActions": [ "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/keyrotationpolicies/read", "Microsoft.KeyVault/vaults/keys/wrap/action", "Microsoft.KeyVault/vaults/keys/unwrap/action" ], "notDataActions": [] } ] ``` If you are planning to use an existing cryptographic key with the same name, it must meet the following criteria: The primary key version should be in the Enabled state. The activation date should either be disabled or set to a date before the KMS configuration creation. The expiration date should be disabled. Permitted operations should have at least WRAPKEY and UNWRAPKEY. The key rotation policy should not be defined in order to avoid automatic rotation. In addition, you need the client ID and secret for an application registered in Azure with permission to encrypt and decrypt using the CMK. Refer to in the Microsoft documentation. For more information, refer to the . {{% /tab %}} {{% tab header="GCP" lang="gcp" %}} To use Cloud KMS, you need the following: CMK (AKA customer-managed encryption key or CMEK) created in Cloud KMS. Cloud KMS resource ID. You can copy the resource ID from KMS Management page in the Google Cloud console. Do not include the key version. For more information, refer to in the GCP documentation. A service account that has been granted the following permissions on the CMK: cloudkms.keyRings.get cloudkms.cryptoKeys.get cloudkms.cryptoKeyVersions.useToEncrypt cloudkms.cryptoKeyVersions.useToDecrypt cloudkms.locations.generateRandomBytes Service account credentials. These credentials are used to authorize your use of the CMK. This is the key file (JSON) that you downloaded when creating credentials for the service account. For more information, refer to in the GCP documentation. For more information on GCP KMS, refer to in the GCP documentation. {{% /tab %}} {{< /tabpane >}} {{< tabpane text=true >}} {{% tab header="AWS" lang="aws" %}} You can enable EAR using a CMK for clusters (database version 2.16.7 and later only) as follows: On the cluster Settings tab, select Encryption at rest. Click Enable Cluster Encryption at Rest. Enter the Amazon Resource Name (ARN) of the CMK to use to encrypt the cluster. Provide an access key of an with permissions for the CMK. An access key consists of an access key ID and the secret access key. {{% /tab %}} {{% tab header="Azure" lang="azure" %}} You can enable EAR using a CMK for clusters (database version 2.16.7 and later only) as follows: On the cluster Settings tab, select Encryption at rest. Click Enable Cluster Encryption at Rest. Provide the Azure , the vault URI (for example,

and the name of the key. Enter the client ID and secret for an application with permission to encrypt and decrypt using the CMK. {{% /tab %}} {{% tab header="GCP" lang="gcp" %}} You can enable EAR using a CMK for clusters (database version 2.16.7 and later only) as follows: On the cluster Settings tab, select Encryption at rest. Click Enable Cluster Encryption at Rest. Enter the resource ID of the key ring where the CMK is stored. Click Add Key to select the credentials JSON file you downloaded when creating credentials for the service account that has permissions to encrypt and decrypt using the CMK. {{% /tab %}} {{< /tabpane >}} Click Save when you are done. YugabyteDB Managed validates the key and, if successful, starts encrypting the data. Only new data is encrypted with the new key. Old data remains unencrypted until compaction churn triggers a re-encryption with the new key. To disable cluster EAR, click Disable Encryption at Rest. YugabyteDB Managed uses lazy decryption to decrypt the cluster. {{< warning title="Deleting your CMK" >}} If you delete a CMK, you will no longer be able to decrypt clusters encrypted using the key. Before deleting a CMK, make sure that you no longer need it. Retain all CMKs used to encrypt data in backups and snapshots. {{< /warning >}} To rotate the CMK used for EAR, do the following: On the cluster Settings tab, select Encryption at rest. Click Edit CMK Configuration. For AWS, provide the following details: Customer managed key (CMK): Enter the Amazon Resource Name (ARN) of the new CMK to use to encrypt the cluster. Access key: Provide an access key of an with permissions for the CMK. An access key consists of an access key ID and the secret access key. For Azure, provide the following details: Provide the Azure , the vault URI (for example, `https://myvault.vault.azure.net`), and the name of the new key. Enter the client ID and secret for the application with permission to encrypt and decrypt using the CMK. For GCP: Resource ID: Enter the resource ID of the key ring where the new CMK is stored. Service Account Credentials: Click Add Key to select the credentials JSON file you downloaded when creating credentials for the service account that has permissions to encrypt and decrypt using the CMK. Click Save. YugabyteDB Managed uses lazy decryption and encryption to encrypt the cluster using the new key.