Encrypting the S3 bucket used to store your data using your AWS Key Management Service (KMS) gives you sole access and management capabilities of the key used to encrypt the bucket. BYOKMS enhances Bring Your Own Key (BYOK) activities. Backups are stored in AWS Simple Storage Service (S3) with a separate S3 bucket for each customer.
Backup buckets are configured to encrypt all objects (data-at-rest) stored on them (server-side encryption).
By default, we manage keys and secrets required for S3 to encrypt and decrypt the stored objects. However, if you need more control over these keys: Importing, revoking, rotating, etc. you can configure your account to use an AWS KMS under your AWS account.
For more information on AWS KMS and S3 see AWS documentation:
Bring Your Own Key Management Service (BYOKMS) is supported as a part of the BYOK option for Recover.
The equivalent to BYOKMS for Azure instances is BYOKV.
Once BYOKMS is enabled, it can't be disabled.
For newly created accounts, you must wait at least 10 minutes before attempting to add BYOKMS, otherwise the validation check might fail.
To view an active key sign in to your account as the account owner. At the top right of the screen, click on your email address and from the drop-down menu, select Account Settings. If there's an active key active, it is displayed on the page.
Setting up BYO-KMS
Your AWS Admin needs to create a customer-managed key in AWS Key Management System (KMS) under your account, and in the same AWS region as your instance. And grant account access to your KMS.
Once onboarded, if you wish to off-board, open a case with Customer Support.
Amazon Resource Names (ARNs) uniquely identify AWS resources. We won't store your ARNs anywhere other than in AWS, in the configuration of the S3 bucket allocated to you. We won't use your key or alias ARNs in any other way.
Creating a Customer-Managed Key in your Key Management System (KMS)
To use BYOKMS, your AWS Admin needs to create a customer-managed key in AWS KMS under your account, and in the same AWS region as your instance. Grant Own account access to your Key Management System.
Once onboarded, if you wish to off-board, open a case with Customer Support.
We won't store your Amazon Resource Names (ARNs) anywhere other than in AWS, in the configuration of the S3 bucket allocated to you. We won't use your key or alias ARNs in any other way.
In your AWS Console, navigate to the Key Management Service (KMS) for the AWS region, that matches the instance region from the table.
| App Server | AWS Region |
|---|---|
| app1 | us-east-1 |
| useast2 | us-east-1 |
| hipaa1 | us-east-1 |
| uk1 | eu-west-2 |
| ca1 | ca-central-1 |
| emea1 | eu-central-1 |
| emea2 | eu-central-1 |
| au1 | ap-southeast-2 |
| usgov2 | us-gov-west-2 |
| sg1 | ap-southeast-1 |
AWS doesn't support cross-region S3 to KMS configurations.
You need to create a new key and follow the on-screen steps. To grant administrative access to users and roles in your organization, select users from your account that will be able to manage the key, according to your organization’s policies and best practices. By clicking Add another AWS account you grant us usage access via the "Other AWS Accounts" section.
Remember to save all the changes.
These are the account numbers.
| App Server | Own Account Number |
|---|---|
| app1 | 222297917904 |
| useast2 | 909132243376 |
| emea2 | 909132243376 |
| uk1 | 222297917904 |
| hipaa1 | 222297917904 |
| ca1 | 222297917904 |
| emea1 | 222297917904 |
| au1 | 222297917904 |
| usgov2 | 051236365672 |
| sg1 | 909132243376 |
Creating a customer-managed key based on cryptographic material from either AWS’s CloudHSM or from outside of AWS is an advanced option and a process not covered in this guide.
Include this code in your key policy (replacing Account Number with the correct value from the table). These are the minimum policy requirements to support BYOKMS:
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Sid”: “Enable IAM User Permissions”,
“Effect”: “Allow”,
“Principal”: {
“AWS”: “arn:aws:iam::Account Number:root”
},
“Action”: [
“kms:Encrypt”,
“kms:Decrypt”,
“kms:ReEncrypt*”,
“kms:GenerateDataKey*”,
“kms:DescribeKey”
],
“Resource”: “*”
}
]
}
For further instructions on how to create and, manage keys in AWS KMS see here and here.
Some of these features make key rotation and other management tasks harder and not transparent.
Submit Your Key and Key Alias ARNs
An Amazon Resource Name (ARN) is a file naming convention used to identify a particular resource in the Amazon Web Services.
Your key has both an ARN and an Alias ARN of the form:
Key ARN:
arn:aws:kms:<aws region>:<your account number>:key/<hex string>Key Alias ARN:
arn:aws:kms:<aws region>:<your account number>:alias/<your alias>Example:
If your account number is 534123456, your KMS is in the us-east-1 region, and you created your key with alias “MyCompany”, the key alias ARN is:
arn:aws:kms:us-east-1:534123456:alias/MyCompanyYour key ARN would look something like this (your hex string at the end will be different):
arn:aws:kms:us-east-1:534123456:key/4aababa9-612c-4125-812a-2a2b12345678If you have backup data in your Own account, then activating BYOKMS requires migrating that data into your dedicated S3 bucket so it can be accessible once BYOKMS is activated. Your backups will continue to run as normal during this process.
Any modification made to your key from your KMS during the activation process can result in errors. Do not rotate or revoke your key until the activation process is complete.
- Log in to your Own account as the account’s owner.
- At the top right of the screen, click on your email address.
- In the drop-down menu, select Account Settings.
- Select the Key Management tab.
- Click Set Up BYOKMS... The Bring Your Own Key Management System window appears.
- Enter the Key ARN and Key Alias ARN in their respective fields.
-
Click Validate Key.
For newly created accounts, wait at least 10 minutes before attempting to add BYOKMS, otherwise the validation check may fail.
-
If the key is valid, a Completed Successfully message will appear in the dialog
window:
- Click Activate.
- Your KMS should appear in the table in resource creation status.
Key Management
Key management involves rotating, revoking, disabling, and deleting customer-managed keys (CMKs) to control access to your backed-up data.
Rotate a Key
There are two ways to rotate a customer-managed key (CMK): automatic key rotation or manually creating a new key.
Automatic rotation changes the cryptography artifacts associated with the key, but does not change the key ID. Such rotation is transparent to Own and can be accomplished via the AWS KMS interface. If your key uses cryptographic artifacts that are from an external system or AWS’s CloudHSM, you can't automatically rotate keys.
If you rotate your key by creating a new key and associate the key alias to this key, you will need to resubmit your Key and Alias ARNs to support. Use this process if your cryptographic material is from CloudHSM or an external system.
Revoking a Key
You can revoke our access to the backed-up data as needed via the AWS KMS admin interface. This is done by removing this AWS account from the “Other AWS Accounts” section of the key policy.
Disabling a Key
To temporarily disable access to your data, you can disable a key by logging in to your AWS account and navigating to Encryption Keys. Once you disable a key, backups, finds, exports, and restore operations will fail. Enable the key to resume these functions.
You won't lose your backed-up data when you disable the key.
Deleting a Key
To permanently disable access to your data, you can initiate a key deletion process by logging in to your AWS account and navigating to Encryption Keys. AWS does not allow you to instantly delete a key, so to immediately and permanently revoke access to your backup data you must first disable the key and then initiate a delete.
Once the key is actually deleted by AWS your data will become INACCESSIBLE to you or anyone else. We nor AWS can help you recover the data, and you will permanently lose all your backed-up data.
Migrate from BYOKMS to BYOK
Own offers a Bring Your Own Key (BYOK) option, where you can provide the encryption key used to manage your data. However, the key itself is stored and managed by Own within its key management system. Similar to BYOKMS, your data is stored in a dedicated S3 bucket and encrypted at rest with your key.
The length of the migration process is dependent on the amount of data you have backed up and can take several weeks. Once the switch has started, it can't be stopped.
All data is still accessible and encrypted throughout the migration process.
Migration can only be done 48 hours after BYOKMS was activated.
- Sign in to your account as the account’s owner.
- At the top right of the screen, click on your email address.
- In the drop-down menu, select Account Settings.
- Select the Key Management tab.
-
Click the three dots menu, then Switch to BYOK.
A warning message will appear.
- Accept and click Switch. The key will be in Activating... status in the table.