Encryption keys
The Encryption Keys page in Cube Cloud allows to manage data-at-rest encryption in Cube Store.
Data-at-rest encryption in Cube Store is available in Cube Cloud on the Enterprise Premier (opens in a new tab) product tier. It also requires the M Cube Store Worker tier.
Navigate to Settings → Encryption Keys in your Cube Cloud deployment to provide, rotate, or drop your own customer-managed keys (CMK) for Cube Store.
Customer-managed keys for Cube Store
On the Encryption Keys page, you can see all previously provided keys:
Add a key
To add an encryption key, click Create to open a modal window. Provide the key name and the key value: an 256-bit AES encryption key, encoded in standard Base64 (opens in a new tab) in its canonical representation.
Once the first encryption key is added, Cube Store will assume that data-at-rest
encryption is enabled. After that, querying unencrypted pre-aggregation partitions
will yield the following error: Invalid Parquet file in encrypted mode. File (or at least the Parquet footer) is not encrypted.
It may take a few minutes for any changes to encryption keys to take effect.
After the refresh worker builds or rebuilds pre-aggregation partitions with respect to their refresh strategy or after they are built manually, their data will be encrypted.
For encryption, the most recently added encryption key is used. For decryption, all previously provided keys can be used, if there are still any pre-aggregation partitions encrypted with those keys.
Rotate a key
To rotate an encryption key, you have to add a new key and then rebuild pre-aggregation partitions using this key, either by the means of the refresh worker, or manually.
You can check which encryption key is used by any pre-aggregation partition by
querying system.tables in Cube Store via SQL Runner:
Only newly built or rebuilt pre-aggregation partitions will be encrypted using the newly added encryption key. Previously built partitions will still be encrypted using previously provided keys. If you drop a key before these partitions are rebuilt, querying them will yield an error.
If you're using incremental pre-aggregations, the refresh worker will likely only rebuild some of their partitions. You have to rebuild them manually to ensure that the new encryption key is used.
Drop a key
To drop an encryption key, click Delete next to it.