Skip to content

Manage Encryption Keys

Audience: System Administrators

Content Summary: Immuta generates data encryption keys (on a user-defined rollover schedule) to encrypt and decrypt values. This page provides an overview of encryption key management and outlines its configuration options in Immuta.

Use an External Key Management Service

Immuta recommends using an external Key Management Service (KMS) to encrypt or decrypt data keys as needed.

Overview

Immuta encrypts values with data encryption keys, either those that are system-generated or managed using an external key management service (KMS). Immuta recommends a KMS to encrypt or decrypt data keys and supports the AWS Key Management Service. To configure the AWS KMS, complete the steps below.

However, if no KMS is configured Immuta will generate a data encryption key on a user-defined rollover schedule, using the most recent data key to encrypt new values while preserving old data keys to decrypt old values. To change the default rollover schedule of 1 year, follow these steps.

1 - Set Up AWS Credentials

Before you can configure the AWS KMS, you need to set up your AWS credentials. Immuta cannot encrypt the AWS access/secret keys in the KMS configuration, so we recommend using IAM roles.

1.1 - Set Up an IAM Role

Choose one of the following options to set up an IAM role:

1.2 - Create an IAM Policy

Follow AWS documentation to create an IAM policy to attach to your IAM role. An example is provided below.

Example IAM Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "kms:Decrypt",
                "kms:Encrypt"
            ],
            "Resource": [
                "{AWS KMS Key ARN}"
            ],
            "Effect": "Allow"
        }
    ]
}

Immuta Cannot Encrypt AWS Access/Secret Keys in KMS Configuration

Immuta cannot encrypt the AWS access/secret keys in the KMS configuration, so we recommend using IAM roles.

Before you begin, create a secret access key and an access key that will authenticate to Immuta.

Navigate to the App Settings page and add the following configuration (with your AWS keyId, region, and credentials) to the Advanced Configuration section:

plugins:
  awsKms:
    plugin: awsKms
    isKms: true
    keyId: <your key id>
    region: <your aws region>
    extraKmsConfig:
      credentials:
        accessKeyId: <your access key id>
        secretAccessKey: <your secret access key>
        sessionToken: <your session token>

Other ways of setting up AWS credentials can be found here.

2 - Configure AWS KMS on the App Settings Page

Add the following configuration (with your AWS region and keyId) to the Advanced Configuration section of the App Settings page.

plugins:
  awsKms:
    plugin: 'awsKms'
    isKms: true
    keyId: <your key id>
    region: <your aws region>

Optional: Define Rollover Schedule

  1. Click the App Settings icon in the left sidebar and scroll to the Advanced Configuration section.

    Advanced Configuration

  2. Paste the following configuration in the text box, adjusting dataKeyRollOverLength days to your desired schedule:

    schedule:
      dataKeyRollOverLength: 365