Project: YugabyteDB (App Definition and Development / Database)
File: encryption-at-rest.md

title: Enable encryption at rest in YugabyteDB clusters headerTitle: Encryption at rest linkTitle: Encryption at rest description: Enable encryption at rest in a YugabyteDB cluster with a user-generated key. headcontent: menu: v2.18: identifier: encryption-at-rest parent: secure weight: 735 type: docs You can enable and disable encryption at rest in a YugabyteDB cluster with a self-generated key. Note that encryption can be applied at the following levels: At the database layer, in which case the encryption process and its associated capabilities, such as key rotation, are cluster-wide. At the file system level, in which case it is the responsibility of the operations teams to manage the process manually on every node. It is important to note that the degree to which file systems or external encryption mechanisms support online operations can vary (for example, when the database processes are still running). You enable encryption as follows: Generate the universe key data of length 32, 40, or 48 by executing the following command on your local file system: ```sh openssl rand -out /path/to/universe_key [ 32 | 40 | 48 ] ``` Note that larger keys are more secure with slightly worse performance. Copy the key to master nodes. In the following example, assume a 3-node RF=3 cluster with `MASTERADDRESSES=ip1:7100,ip2:7100,ip3:7100`. Choose any string `<keyid>` for this key and use yb-admin to copy the key to each of the masters: ```sh yb-admin -masteraddresses $MASTERADDRESSES adduniversekeytoallmasters <keyid> /<pathtouniverse_key> ``` The preceding operation does not perform the key rotation, but rather seeds each master's in-memory state. The key only lives in memory, and the plaintext key is never persisted to the disk. Enable cluster-wide encryption. Before rotating the key, ensure that the masters know about `<key_id>`: ```sh yb-admin -masteraddresses $MASTERADDRESSES allmastershaveuniversekeyinmemory <key_id> ``` If the preceding command fails, rerun step

Once this succeeds, instruct the cluster to start using the new universe key, as follows: ```sh yb-admin -masteraddresses $MASTERADDRESSES rotateuniversekeyinmemory <key_id> ``` Because data is encrypted in the background as part of flushes to disk and compactions, only new data is encrypted. Therefore, the call should return quickly. Verify that encryption has been enabled. To do this, check the encryption status of the cluster by executing the following yb-admin command: ```sh yb-admin -masteraddresses $MASTERADDRESSES isencryptionenabled ``` Expect the following output: ```output Encryption status: ENABLED with key id <key_id> ``` You can rotate the new key as follows: Create the key to be rotated by executing the following command: ```sh openssl rand -out /pathtouniversekey2 [ 32 | 40 | 48 ] ``` Make sure to use a different key path to avoid overwriting the previous key file. Copy the new key to master nodes, informing the master nodes about the new key, as follows: ```sh yb-admin -masteraddresses $MASTERADDRESSES adduniversekeytoall_masters <keyid2> /pathtouniversekey2 ``` `<key_id>` must be different from any previous keys. Ensure that the masters know about the key, and then perform the rotation, as follows: ```sh yb-admin -masteraddresses $MASTERADDRESSES rotateuniversekeyinmemory <keyid2> ``` Since this key is only used for new data and can only eventually encrypt older data through compactions, it is best to ensure old keys remain secure. Verify the new key. To do this, check that the new key is encrypting the cluster, as follows: ```sh yb-admin -masteraddresses $MASTERADDRESSES isencryptionenabled ``` Expect the following output: ```output Encryption status: ENABLED with key id <keyid2> ``` `<keyid2>` must be different from the previous `<key_id>`. You can disable cluster-wide encryption as follows: Disable encryption by executing the following yb-admin command: ```sh yb-admin -masteraddresses $MASTERADDRESSES disable_encryption ``` Verify that the encryption has been disabled by executing the following command: ```sh yb-admin -masteraddresses $MASTERADDRESSES isencryptionenabled ``` Expect the following output: ```output Encryption status: DISABLED ```