TLS supports encrypted data storage and uses Key Management Service (KMS) from Volcanoengine to encrypt log topic-level data. This topic describes the steps to encrypt TLS data using customer-managed keys (SSE-KMS).

Data encryption overview #

Limits #

• If the primary key is deleted or disabled, the customer-managed key becomes invalid. After the primary key becomes invalid, all read and write requests for the corresponding log topic will fail.
• When configuring data encryption, once the encryption mechanism is selected, it is not supported to modify the data encryption mechanism. Encryption can only be enabled or disabled by configuring the EncryptConf parameter's enable setting in the API. Additionally, when updating a log topic subsequently, the complete EncryptConf parameter must be included each time.
  For example, if the service-managed key encryption mechanism is initially selected, it cannot be later changed to customer-managed key encryption.

Billing notes #

Use cases #

Encryption configuration steps #

When using TLS service-managed keys (SSE-TLS) for encryption, you can simply add the EncryptConf structure parameter to your API request to complete the encryption setup.
When using customer-managed keys (SSE-KMS) for encryption, you can follow these steps to configure the Key Management System.

1. Configure the Key Management System #

1. Enable Key Management System (KMS) in the same region as TLS.
2. Create a customer master key and obtain the key ID. For details, refer to Key Management Quick Start and Bring Your Own Key.

2. Configure TLS #

1. Configure TLS cross-service access to KMS. For details, see cross-service access authorization.

2. Grant user roles KMS encryption/decryption permissions and KMS read-only permissions, configure TLS trust relationships, and record the role TRN.

   1. Log in to the IAM console.

   2. In the left navigation bar, click Role Management.

   3. Locate the role to be authorized, and in the Actions column, click Authorize.

   4. Under Service, search for Key Management Service and click the KMSCryptoUserAccess and KMSReadOnlyAccess policies. And then click Submit.

   5. Click the name of the role to be authorized. Then go to the Trust relationships tab and click Edit trust policy. Add the following content, and click Save.

      {
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "sts:AssumeRole"
                  ],
                  "Principal": {
                      "Service": [
                          "TLS"
                      ]
                  }
              }
          ]
      }
      

   6. Under Basic information, record the role TRN.

3. Configure data encryption.
   Only supported via API calls. When calling the API, add the EncryptConf structure parameter to the request to complete encryption settings. Supported API:

   API	API Description
   CreateTopic	Create a TLS topic. For details, refer to CreateTopic.
   ModifyTopic	Modify the log topic information. For details, refer to ModifyTopic.

Request parameters #

EncryptConf

EncryptUserCmkConf

API example #

Using user-managed keys (SSE-KMS) encryption as an example.

EncryptConf = {
    "enable" : true,            
    "encrypt_type" : "default"  
    "user_cmk_info" :           
    {
          "trn" :  "trn:iam::123456789:role/service_role_for_tls"         
          "region_id" : "ap-southeast-1"      
          "user_cmk_id" : "fc227edb-3682-4577-a3b5xxxxxxxxx"     
    }
}