Database-level Encryption¶

Encryption with Multiple Datacenters¶

When you add one or more new DC (datacenter), your key will be replicated across the DCs you added.

Adding new datacenters to the ScyllaDB cluster will create additional local keys in those regions. All customer managed keys support multi-region, and a copy of each key resides locally in each region – ensuring those multi-regional setups are protected from regional outages for the cloud provider or against any disaster.

The keys are available in the same region as the datacenter and can be controlled independently.

CMK on Amazon Web Services¶

To create and assign your AWS CMK to ScyllaDB Cloud:

1. Go to Managed Resources via the drop-down in the top right corner next to your username.

2. Open the Customer Managed Key tab.

3. Click Add Key to open the Add Key pop-up.

4. Choose Amazon Web Services from the Provider drop-down.

5. Select the region where you want the key to be valid using the Region drop-down (the default is US East (N. Virginia)).

6. Click Set Key to store the key entry in ScyllaDB Cloud and display the summary pop-up.

   This will be the key for your starting datacenter. If you add more datacenters later, the key will be automatically replicated in each region.

   Note that the key is not ready for use yet. You need to proceed to provision the key in AWS.

7. Click Launch Stack in the summary pop-up to open the (AWS) CloudFormation Stack in a new tab to provision your key in the AWS KMS store.

8. Once created, you can go back to the ScyllaDB Cloud to click I’m done provisioning in the pop-up.

CMK on Google Cloud Platform¶

To create and assign your GCP CMK to ScyllaDB Cloud:

1. Go to Managed Resources via the drop-down in the top right corner next to your username.

2. Open the Customer Managed Key tab.

3. Click Add Key to open the Add Key pop-up.

4. Choose your Google Cloud Platform from the Provider drop-down.

   The Region drop-down will become inactive as the key will be valid globally.

5. Click Next to open the Add GCP Key pop-up.

6. In the Add GCP Key pop-up, you can determine whether you want to use a key ring that already exists in your GCP or create a new one.

   A key ring organizes keys in a specific GCP location. It allows you to manage access control on groups of keys and organize keys by project or application. See Key rings in the GCP KMS documentation for details.

   To create a new key ring:

   1. Enable the Create new key Ring for me checkbox.

   2. Click Next.

   3. In the Project ID field, specify your project ID.

      You can copy your project ID from the Google Cloud Console.

   To use an existing key ring:

   1. Leave the Create new key Ring for me checkbox disabled.

   2. Click Next.

   3. In the Key ring field, specify an existing key ring.

      To obtain a list of existing key rings, go to the Google Cloud Console and navigate to Security> Key Management. Here, you can review the existing key rings and keys associated with each key ring. NOTE: Make sure your desired project is selected.

7. Click Generate template to generate a Terraform template that includes all files required for provisioning the cloud resources.

8. Click Download template to download the Terraform template (a ZIP archive).

9. Unzip the archive.

10. In a terminal, navigate to the unzipped directory and run the following terraform commands to provision the key:

    terraform init   // Prepare
    terraform plan   // Dry run
    terraform apply  // Execute
    
    You will be prompted to enter the Template Secret:
    

    316CeQo8Ioj2RHiGBdaCt1NkEA0ZC3oJrtP1
    

    Type “yes” to confirm.

11. Once the script completes successfully, go back to the Add GCP Key pop-up in ScyllaDB Cloud and click Done.

You can review your newly added key in the Customer Managed Key section.