You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Data at rest is encrypted by default using cloud provider-managed AES 256 keys. Customers may enable Transparent Data Encryption (TDE) to provide an additional layer of protection for service data. Additionally, customers may supply their own key to implement Customer Managed Encryption Keys (CMEK) for their service.
14
+
Data at rest is encrypted by default using cloud provider-managed AES 256 keys. Customers may enable Transparent Data Encryption (TDE) to provide an additional layer of protection for service data or supply their own key to implement Customer Managed Encryption Keys (CMEK) for their service.
15
15
16
16
Enhanced encryption is currently available in AWS and GCP services. Azure is coming soon.
17
17
@@ -21,51 +21,55 @@ TDE must be enabled on service creation. Existing services cannot be encrypted a
21
21
22
22
1. Select `Create new service`
23
23
2. Name the service
24
-
3. Select AWS as the cloud provider and the desired region from the drop-down
24
+
3. Select AWS or GCP as the cloud provider and the desired region from the drop-down
25
25
4. Click the drop-down for Enterprise features and toggle Enable Transparent Data Encryption (TDE)
Deleting a KMS key used to encrypt a ClickHouse Cloud service will cause your ClickHouse service to be stopped and its data will be unretrievable, along with existing backups.
31
+
Deleting a KMS key used to encrypt a ClickHouse Cloud service will cause your ClickHouse service to be stopped and its data will be unretrievable, along with existing backups. To prevent accidental data loss when rotating keys you may wish to maintain old KMS keys for a period of time prior to deletion.
32
32
:::
33
33
34
-
Once a service is encrypted with TDE, customers may update the key to enable CMEK. The service will automatically restart after updating the Transparent Data Encryption setting. During this process, the old KMS key decrypts the data encrypting key (DEK), and the new KMS key re-encrypts the DEK. This ensures that the service on restart will use the new KMS key for encryption operations moving forward. This process may take several minutes.
35
-
36
-
### CMEK with AWS KMS {#cmek-with-aws-kms}
34
+
Once a service is encrypted with TDE, customers may update the key to enable CMEK. The service will automatically restart after updating the TDE setting. During this process, the old KMS key decrypts the data encrypting key (DEK), and the new KMS key re-encrypts the DEK. This ensures that the service on restart will use the new KMS key for encryption operations moving forward. This process may take several minutes.
37
35
36
+
<details>
37
+
<summary>Enable CMEK with AWS KMS</summary>
38
+
38
39
1. In ClickHouse Cloud, select the encrypted service
39
40
2. Click on the Settings on the left
40
41
3. At the bottom of the screen, expand the Network security information
41
42
4. Copy the Encryption role ID (AWS) or Encryption Service Account (GCP) - you will need this in a future step
42
43
5.[Create a KMS key for AWS](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html)
43
44
6. Click the key
44
45
7. Update the AWS key policy as follows:
45
-
46
+
46
47
```json
47
48
{
48
49
"Sid": "Allow ClickHouse Access",
49
-
"Effect": "Allow",
50
-
"Principal": {
51
-
"AWS": "{ Encryption role ID }"
52
-
},
53
-
"Action": [
54
-
"kms:Encrypt",
55
-
"kms:Decrypt",
56
-
"kms:ReEncrypt",
57
-
"kms:DescribeKey"
58
-
],
59
-
"Resource": "*"
50
+
"Effect": "Allow",
51
+
"Principal": {
52
+
"AWS": "{ Encryption role ID }"
53
+
},
54
+
"Action": [
55
+
"kms:Encrypt",
56
+
"kms:Decrypt",
57
+
"kms:ReEncrypt",
58
+
"kms:DescribeKey"
59
+
],
60
+
"Resource": "*"
60
61
}
61
62
```
62
-
63
+
63
64
10. Save the Key policy
64
65
11. Copy the Key ARN
65
66
12. Return to ClickHouse Cloud and paste the Key ARN in the Transparent Data Encryption section of the Service Settings
66
67
13. Save the change
68
+
69
+
</details>
67
70
68
-
### CMEK with GCP KMS {#cmek-with-gcp-kms}
71
+
<details>
72
+
<summary>Enable CMEK with GCP KMS</summary>
69
73
70
74
1. In ClickHouse Cloud, select the encrypted service
71
75
2. Click on the Settings on the left
@@ -80,21 +84,21 @@ Once a service is encrypted with TDE, customers may update the key to enable CME
80
84
11. Copy the Key Resource Path
81
85
12. Return to ClickHouse Cloud and paste the Key Resource Path in the Transparent Data Encryption section of the Service Settings
82
86
13. Save the change
87
+
88
+
</details>
89
+
90
+
## Key Rotation {#key-rotation}
91
+
92
+
Once you set up CMEK, rotate the key by following the procedures above for creating a new KMS key and granting permissions. Return to the service settings to paste the new ARN (AWS) or Key Resource Path (GCP) and save the settings. The service will restart to apply the new key.
83
93
84
94
## Backup and Restore {#backup-and-restore}
85
95
86
-
Backups are encrypted using the same key as the associated service. When you restore an encrypted backup, it creates an encrypted instance that uses the same KMS key as the original instance. If needed, you can rotate the KMS key; see [Key Rotation](#key-rotation) for more details.
96
+
Backups are encrypted using the same key as the associated service. When you restore an encrypted backup, it creates an encrypted instance that uses the same KMS key as the original instance. If needed, you can rotate the KMS key after restoration; see [Key Rotation](#key-rotation) for more details.
87
97
88
98
## KMS Key Poller {#kms-key-poller}
89
99
90
100
When using CMEK, the validity of the provided KMS key is checked every 10 minutes. If access to the KMS key is invalid, the ClickHouse service will stop. To resume service, restore access to the KMS key by following the steps in this guide, and then restart the service.
91
101
92
-
Due to the nature of this feature, it's not possible to recover a ClickHouse Cloud service after the KMS key has been deleted. To prevent this, most providers don't remove the key immediately and instead schedule it for deletion, please check your provider documentation.
93
-
94
-
## Key Rotation {#key-rotation}
95
-
96
-
Due to the nature of this feature, it is not possible to recover a ClickHouse Cloud service if the KMS key has been deleted. To prevent accidental loss, most providers schedule key deletion rather than removing it immediately. For more details, refer to your provider’s documentation.
97
-
98
102
## Performance {#performance}
99
103
100
104
As specified in this page, we use ClickHouse's built-in [Virtual File System for Data Encryption feature](/operations/storing-data#encrypted-virtual-file-system) to encrypt and protect your data.
0 commit comments