Encryption at rest in Elastic Cloud: Bring your own key with AWS KMS
![serverless-launch-blog-image.jpg](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt61153c9ba37071f1/66ab96a82b7be52085a78af7/serverless-launch-blog-image.jpg)
In the previous blog of this series, we unpacked the foundational concepts of encryption at rest and introduced you to Elastic Cloud’s “bring your own key” (BYOK) feature, which allows you to do encryption at rest with encryption keys managed by the KMS service of your cloud provider. Building on that knowledge, this blog dives into the technical nuances of implementing encryption at rest with AWS KMS keys and Elastic Cloud deployments, providing you with a secure and compliant environment for your sensitive data.
We will first walk through the architecture of the solution and its prerequisites, and then we will explore how to create an AWS KMS key and apply it to an Elastic Cloud Hosted deployment for encrypting data and snapshots at rest. Additionally, we’ll show you how to validate your setup and how to implement additional security policies, such as encryption key rotation and revocation.
The Elastic Cloud and AWS KMS integration
Architecture
The following diagram showcases how Elastic Cloud integrates with AWS KMS to provide your application with Hosted Stack deployments encrypted with your own KMS keys.
![architecture](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt99fa83d2d4e8021f/66ab99c155b235ee16e7ce77/1.png)
Prerequisites
1. Get your own key: To use BYOK, you need a key that you control. You set this up in your AWS KMS account. Create a symmetric single-region key or multi-region replica key. The key must be available in each region in which you have deployments to encrypt. You can use the same key to encrypt multiple deployments, although security best practices recommend using a different one per deployment. Later, you will need to provide the Amazon Resource Name (ARN) of that key or key alias to Elastic Cloud. We currently support the following key material origin types:
KMS: AWS Created Key Material
External: Imported Key Material
External Key Store (XKS): Key Material Provided Via AWS XKS Proxy
2. Upgrade to Enterprise: BYOK is available for the Enterprise subscription level. This means if you're using Elastic on AWS, you can encrypt your data using your own key. Other cloud providers will have this feature later on.
Keep in mind: If you're using a custom snapshot repository instead of Elastic Cloud's default one, your snapshots won't automatically be encrypted with your key. However, the file system itself will still encrypt data being stored on disk.
3. Access control: Create AWS Identity and Access Management (IAM) policies to control access to the Elastic cluster.
Creating and configuring an AWS KMS key
To start the key creation process, go to the KMS in the AWS console. Click Create a key.
![aws kms](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt6acb83af578f3e72/66ab99f1eb20b486832d1fc2/2.png)
In Step 1 of the key creation process, click Next.
![config key](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/bltd978ec24c4abd95d/66ab9a0eadec833f252d2ded/3.png)
In Step 2 of the key creation process, enter an Alias for the key and click Next.
![add labels](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt3486c4fa91531e2f/66ab9a3355b2352cc2e7ce7c/4.png)
In Step 3, you have the option to add key administrators. Click Next.
![define key admin permissions](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt0dd1cb320426e472/66ab9a537cd4c9b5a7397c4a/5.png)
In Step 4, you have the option to add key users. Click Next.
![define key usage permissions](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt8c40d599141364d7/66ab9a74a4a657f0da1e051f/6.png)
Click Finish to create the KMS key.
![review](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt772e43ff6e6956c7/66ab9a97c10344cc8c069668/7.png)
Click View key to see the details of the newly created key.
![view key](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt4c3b57b3cd6a81ed/66ab9aa42b7be55745a78b27/8.png)
Start the process of updating the key to add Elastic to the key policy. Click Switch to policy view in the Key policy section.
![switch to policy view](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blta681a3746b21c49d/66ab9ac4adec835c162d2dfb/9.png)
Click Edit to edit the key’s policy.
![edit](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/bltb04af094f741fd86/66ab9addeb20b42ed72d1fd9/10.png)
Copy the following code and paste it within the existing key policy.
,
{
"Sid": "ElasticKeyAccess",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GetKeyRotationStatus",
"kms:GenerateDataKey",
"kms:DescribeKey"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringLike": {
"aws:PrincipalOrgPaths": "o-ygducmlz12/r-e5t3/ou-e5t3-fzpdq76p/ou-e5t3-ysfcmd95/ou-e5t3-hwt05su3/"
}
}
}
Your updated key policy should look something like this. Note that PrincipleOrgPaths is a fixed value, which refers to the Elastic tenant. Click Save changes.
![edit key policy](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt435291629a612643/66d9ef241f846436162f3cbe/replacement-image.png)
Now that your KMS key is ready for use, click the Aliases tab to access the key alias.
![aliases](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blte3137f59189bb98d/66ab9cd4bb95128362024eda/12.png)
Copy the key Alias ARN. Save it in a safe place for use in a later step.
![alias arn](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt04d514e1676f4a58/66ab9cf659c15c0474434325/13.png)
Integrating an AWS KMS key with Elastic Cloud
Now you can create a new Elastic deployment that uses the AWS KMS key you just created. Start by signing in to the Elastic Cloud console.
![eastic cloud console](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt185e6fea11293233/66ab9d122b7be5789fa78b52/14.png)
After you’ve signed in to the console, click the Create deployment button.
![create deployment](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt21f24384a33a31c1/66ab9d332fce4505a16fefae/15.png)
Enter a name for your deployment and select Amazon Web Services as your Cloud provider.
Then expand the Advanced settings section and enable the Use a customer-managed encryption key option. Paste in the AWS KMS key’s Alias ARN that you copied at the end of the previous section. Click Create deployment.
![create a deployment](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blte62aa7c2d6635c9c/66ab9d57bb95125d36024ee2/16.png)
The deployment is now created and encrypted using the specified key.
Verification and troubleshooting
In the Elasticsearch Service Console, you can check that your hosted deployment is correctly encrypted with the key you specified. To do that, go to the deployment’s Security page by selecting Security from the left navigation menu.
![my deployment](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt649a8acc0609b358/66ab9d85bb9512b27a024ee9/17.png)
Select Manage encryption key in the Encryption at rest section.
![manage encryption key](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blta12f6f543f2cee5c/66ab9da3610c41e0e24224a6/18.png)
You should see your AWS KMS key Alias ARN listed in the AWS KMS key ARN field.
![security manage encryption key](https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt02d4200888bc1fe6/66ab9dc1d141065a27557da6/19.png)
Key rotation and revocation
Elastic Cloud Hosted deployments that have been encrypted with AWS KMS keys also support AWS KMS key security policies and features, such as key rotation and key revocation. Key rotation minimizes the risk of data leaks due to key compromise. Key revocation is an additional security measure, where access to encrypted data via a compromised key is terminated, either via disabling/deleting the key or by changing the key’s IAM policy.
AWS KMS keys are automatically rotated after one year by default, but this rotation period can be customized. KMS keys can also be manually rotated within AWS as necessary. Elastic seamlessly handles AWS KMS key rotations so the data in your Elastic Cloud deployment will remain encrypted and accessible via your most current AWS KMS key.
If the current key is ever compromised, you can manually revoke the key in AWS KMS. This is a “break-glass” operation to use in case of a security breach. No more than 30 minutes from when a key is revoked, Elastic Cloud will lock the deployment’s data directories and prompt you to delete the deployment. You can restore the key if it’s unintentionally revoked. The deployment will resume operation once the key is restored.
Conclusion
You’ve now seen the entire process of how BYOK can be used for encryption of an Elastic deployment running on AWS. First the AWS KMS key was created and given the policy settings required for Elastic to manage and rotate the key’s credentials over time. Then, an Elastic Cloud deployment was created to utilize that very same key for encryption of the data contained within the deployment.
Stay tuned for a follow-up blog post to this one, which will cover how to BYOK to Elastic Cloud deployments running on Microsoft Azure using the Azure Key Vault.
Try it out for yourself today. Create an Elastic Cloud deployment with your own AWS KMS key to enhance the overall security of your Elastic Cloud deployment.
The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.