Home/Templates/Encryption keys you control and can switch off
Encryption keys you control and can switch off
Your own keys, rotated on a schedule, with a usage log and an off switch.
Terraform
Why bother
Encryption the cloud manages for you ticks a box. It gives you no way to see who used the key and no way to cut off access in a hurry. Your own key gives you both.
How you know it worked
Disable the key. Reads of the protected data should start failing.
Not written yet
No code exists for this one. It is listed so the gap shows on the coverage table. When it is written, each platform will use:
| Platform | Service |
|---|---|
| AWS | A KMS key with yearly rotation and a deny-by-default key policy |
| Azure | A Key Vault key with purge protection |
| Google Cloud | A Cloud KMS key ring with a rotation schedule |
| Oracle Cloud | An OCI Vault master encryption key |