Data keys
A data key encrypts database backup artifacts. When you create a cluster, myStack automatically provisions a dedicated system-managed data key for that cluster.
Automatic provisioning
You do not need to create a data key before you create a database. For each new cluster, myStack:
- Generates a dedicated data key
- Marks it as System-managed
- Attaches it to the cluster for backup encryption
Important
You cannot edit or delete a system-managed data key. You also cannot delete a data key that is still attached to one or more databases.
In the console
Choose Encryption, Data Keys.
To create a user-managed data key
Create a user-managed key when you restore or migrate and need to supply your own encryption key.
- Choose Encryption, Data Keys, then create a data key.
- For Name, enter a name.
- For Value, enter the key material.
- Choose Save.
Fields
| Field | Description |
|---|---|
| Name | Display name for the data key |
| Value | Secret key material (masked in the console) |
| Type | System-managed (auto-provisioned for a cluster) or User-managed |
Restore and migrations
When you restore from a backup, choose the data key that encrypted that backup so myStack can decrypt the artifacts.