Skip to content

Add CMEK instructions for GCP #3249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Feb 12, 2025
Merged

Add CMEK instructions for GCP #3249

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1bf8602
Add CMEK instructions for GCP
leticiawebb Feb 6, 2025
5eb5871
Update aspell-dict.txt
vinay92-ch Feb 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 26 additions & 10 deletions docs/en/cloud/security/cmek.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ import EnterprisePlanFeatureBadge from '@theme/badges/EnterprisePlanFeatureBadge

Data at rest is encrypted by default using cloud provider-managed AES 256 keys. Customers may enable Transparent Data Encryption (TDE) to provide an additional layer of protection for service data. Additionally, customers may supply their own key to implement Customer Managed Encryption Keys (CMEK) for their service.

Enhanced encryption is currently available in AWS services. Other cloud providers are coming soon.
Enhanced encryption is currently available in AWS and GCP services. Azure is coming soon.

## Transparent Data Encryption (TDE)

Expand All @@ -30,15 +30,17 @@ TDE must be enabled on service creation. Existing services cannot be encrypted a
Deleting a KMS key used to encrypt a ClickHouse Cloud service will cause your ClickHouse service to be stopped and its data will be unretrievable, along with existing backups.
:::

Once a service is encrypted with TDE, customers may update the key to enable CMEK.
Once a service is encrypted with TDE, customers may update the key to enable CMEK. The service will automatically restart after updating the Transparent Data Encryption setting. During this process, the old KMS key decrypts the data encrypting key (DEK), and the new KMS key re-encrypts the DEK. This ensures that the service on restart will use the new KMS key for encryption operations moving forward. This process may take several minutes.

### CMEK with AWS KMS

1. In ClickHouse Cloud, select the encrypted service
2. Click on the Settings on the left
3. At the bottom of the screen, expand the Network security information
4. Copy the Encryption role ID - you will need this in a future step
5. In AWS, [create a KMS key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html)
4. Copy the Encryption role ID (AWS) or Encryption Service Account (GCP) - you will need this in a future step
5. [Create a KMS key for AWS](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html)
6. Click the key
7. Edit the Key policy as follows
7. Update the AWS key policy as follows:

```json
{
Expand All @@ -57,12 +59,26 @@ Once a service is encrypted with TDE, customers may update the key to enable CME
}
```

9. Save the Key policy
10. Copy the Key ARN
11. Return to ClickHouse Cloud and paste the Key ARN
12. Save the change
10. Save the Key policy
11. Copy the Key ARN
12. Return to ClickHouse Cloud and paste the Key ARN in the Transparent Data Encryption section of the Service Settings
13. Save the change

### CMEK with GCP KMS

The service will automatically restart. During this process, the old KMS key decrypts the data encrypting key (DEK), and the new KMS key re-encrypts the DEK. This ensures that the service on restart will use the new KMS key for encryption operations moving forward. This process may take several minutes.
1. In ClickHouse Cloud, select the encrypted service
2. Click on the Settings on the left
3. At the bottom of the screen, expand the Network security information
4. Copy the Encryption Service Account (GCP) - you will need this in a future step
5. [Create a KMS key for GCP](https://cloud.google.com/kms/docs/create-key)
6. Click the key
7. Grant the following permissions to the GCP Encryption Service Account copied in step 4 above.
- Cloud KMS CryptoKey Encrypter/Decrypter
- Cloud KMS Viewer
10. Save the Key permission
11. Copy the Key Resource Path
12. Return to ClickHouse Cloud and paste the Key Resource Path in the Transparent Data Encryption section of the Service Settings
13. Save the change

## Backup and Restore

Expand Down
3 changes: 3 additions & 0 deletions scripts/aspell-ignore/en/aspell-dict.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,6 +222,7 @@ Cramer's
Criteo
Crotty
Crowdsourced
CryptoKey
Ctrl
CurrentMetrics
CustomSeparated
Expand All @@ -241,6 +242,7 @@ DDLWorkerThreads
DDLWorkerThreadsActive
DDLs
DECRYPT
Decrypter
DELETEs
DESC
DIEs
Expand Down Expand Up @@ -323,6 +325,7 @@ Embeddable
EmbeddedRocksDB
Embeddings
Encodings
Encrypter
Enum
Enums
Eoan
Expand Down