Create a KMS configuration

Encryption at rest uses a master key to encrypt and decrypt universe keys. The master key details are stored in YugabyteDB Anywhere in key management service (KMS) configurations. You enable encryption at rest for a universe by assigning the universe a KMS configuration. The master key designated in the configuration is then used for generating the universe keys used for encrypting the universe data.

• AWS
• Google
• Azure
• OCI
• HashiCorp
• CipherTrust

Encryption at rest in YugabyteDB Anywhere supports the use of OCI Vault.

If you are planning to use an existing cryptographic key with the same name, it must meet the following criteria:

• The key should be in the Enabled state.
• The purpose should be set to symmetric encryption (AES). YugabyteDB Anywhere uses AES-256.

Note that YugabyteDB Anywhere does not manage the vault. Deleting the KMS configuration does not delete the vault, master key, or key versions on OCI Vault.

Prerequisites

The OCI user or instance principal associated with a KMS configuration requires permissions to manage keys in the vault. See To use encryption at rest with YugabyteDB Anywhere.

Create the vault in the OCI Console before you create the KMS configuration. YugabyteDB Anywhere uses the vault you specify; it creates a key in that vault only if a key with the given display name does not already exist.

Create a KMS configuration

You can create a KMS configuration that uses OCI Vault, as follows:

1. Navigate to Integrations > Security > Encryption At Rest to access the list of existing configurations.

2. Click Create New Config.

3. Enter the following configuration details in the form:

   • Configuration Name — Enter a meaningful name for your configuration.
   • KMS Provider — Select OCI KMS.
   • Authentication Type — Choose API Key to supply OCI API signing key credentials, or Instance Principal to use the YBA host's instance identity without storing credentials.
   • User OCID, Tenancy OCID, Fingerprint, and Private Key — Required when using API Key authentication. Upload the PEM private key file.
   • Region — Select the OCI region where the vault and key are located. This setting does not need to match the region where the encrypted universe resides.
   • Compartment OCID — OCID of the compartment where the key will be created (or already exists).
   • Vault OCID — OCID of the vault that will contain the encryption key.
   • Key Name — Display name of the OCI Vault key. If a key with this name exists, YugabyteDB Anywhere uses it; otherwise it creates one.

4. Click Save.

   Your new configuration should appear in the list of configurations.

5. Optionally, to confirm that the information is correct, click Show details. Note that sensitive configuration values are displayed partially masked.

Modify a KMS configuration

You can modify an existing KMS configuration as follows:

1. Navigate to Integrations > Security > Encryption At Rest to open a list of existing configurations.

2. Find the configuration you want to modify and click its corresponding Actions > Edit Configuration.

3. You can update the API signing key credentials (User OCID, Tenancy OCID, Fingerprint, and Private Key) and the Compartment OCID. Authentication type, region, vault OCID, and key name cannot be changed.

4. Click Save.

5. Optionally, to confirm that the information is correct, click Show details or Actions > Details.

Delete a KMS configuration

To delete a KMS configuration, click its corresponding Actions > Delete Configuration.