Manage AWS KMS keys

This topic describes how to create or modify AWS KMS keys and authorize OceanBase Cloud to use these keys for data encryption.

Background information

When creating a cluster instance in OceanBase Cloud and selecting AWS as the cloud provider, you can enhance security by using custom keys for data encryption. You can configure these keys in the AWS Management Console.

• [Create a new key](#Create a new key): Generate a new key specifically for OceanBase Cloud.
• [Configure an existing key](#Configure an existing key): Add account permissions for OceanBase Cloud to an existing key.

Create a new key

1. Log in to the AWS Management Console and go to the Key Management Service (KMS) console.

2. In the left-side navigation pane, click Customer managed keys, then click Create key in the upper-right corner.

   

   1. Configure the key: Set the key type and usage as needed, then click Next.

      

   2. Add tags: Fill in the Alias, Description, and Tags fields, then click Next.

      

   3. Define key management permissions: Select a key administrator, then click Next.

      

   4. Define key usage permissions: After adding key users, add the OceanBase Cloud account to the Other AWS accounts section (you can contact OceanBase Technical Support to obtain this account information), then click Next.

      

   5. Review the key information: Check the provided information and click Finish if it is correct.

   After creation, you will be redirected to the Customer managed keys page, where you can view the list of created keys.

3. On the Customer managed keys page, click the alias of the key you just created.

4. On the key details page, find the ARN information for the key in the General configuration section.

   This information will be used to enable data encryption when creating a cluster instance in the OceanBase Cloud console. For more details, see Create a cluster instance.

   

Configure an existing key

1. Log in to the AWS Management Console and go to the Key Management Service (KMS) console.

2. In the left-side navigation pane, click Customer managed keys, then click the name of the key you want to configure.

3. On the Key Details page, under the Key policy tab, in the Other AWS accounts section, click Add other AWS accounts.

   

4. In the dialog box that appears, enter the OceanBase Cloud account (you can contact OceanBase Technical Support to obtain this account information), then click Save changes.

   

5. On the Key Details page, find the ARN information for the key.

   This information will be used to enable data encryption when creating a cluster instance in the OceanBase Cloud console. For more details, see Create a cluster instance.