Hyper Protect Crypto Services Integration

Creating or adding a key in Hyper Protect Crypto Services

Navigate to your instance of Hyper Protect Crypto Services and generate or enter a key.

Granting service authorization

Authorize Hyper Protect Crypto Services for use with Cloud Databases deployments:

1. Open your IBM Cloud dashboard.
2. From the menu bar, click Manage > Access (IAM).
3. In the side navigation, click Authorizations.
4. Click Create.
5. In the Source service menu, select Db2.
6. In the Source service instance menu, select All instances.
7. In the Target service menu, select HPCS.
8. Select or retain the default value Account as the resource group for the Target Service
9. In the Target service Instance ID menu, select the service instances to authorize.
10. Enable the Reader role.
11. Click Authorize.

If the service authorization is not present before provisioning your deployment with a key, the provision fails.

Using the HPCS Key

After you grant your Cloud Databases deployments permission to use your keys, you supply the key name or CRN when you provision a deployment. The deployment uses your encryption key to encrypt your data.

If provisioning from the catalog page, select the HPCS instance and key from the dropdown menus.

In the CLI, use the disk_encryption_key_crn parameter in the parameters JSON object.

ibmcloud resource service-instance-create example-database <service-name> standard us-south \
-p \ '{
  "disk_encryption_key_crn": "crn:v1:<...>:key:<id>"
}'

In the API, use the disk-encryption-key parameter in the body of the request.

curl -X POST \
  https://resource-controller.cloud.ibm.com/v2/resource_instances \
  -H 'Authorization: Bearer <>' \
  -H 'Content-Type: application/json' \
    -d '{
    "name": "my-instance",
    "target": "blue-us-south",
    "resource_group": "5g9f447903254bb58972a2f3f5a4c711",
    "resource_plan_id": "databases-for-x-standard",
    "disk_encryption_key_crn": "crn:v1:<...>:key:<id>"
  }'

If you provision a deployment through the CLI or API, the HPCS key needs to be identified by its full CRN, not just its ID. An HPCS CRN is in the format crn:v1:<...>:key:<id>.

Key Rotation

HPCS offers manual and automatic key rotation and key rotation is supported by Cloud Databases deployments. When you rotate a key, the process initiates a Syncing KMS state task, and your deployment is reencrypted with the new key. The task is displayed on the Tasks panel on your deployment's Overview and the associated HPCS and Cloud Databases events are sent to Activity Tracker.

Deleting the Deployment

If you delete a deployment that is protected with an HPCS key, the deployment remains registered against the key during the soft-deletion period (up to 7 days). If you need to delete the key in the soft-deletion period, you must force delete the key. After the soft-deletion period, the key can be deleted without the force. You can check the association between the key and your deployment to determine when you can delete the key.

Cryptoshredding

Cryptoshredding is a destructive action. When the key is deleted, your data is unrecoverable.

Hyper Protect Crypto Services enables initiation of a force delete of a key that is in use by IBM Cloud® services, including your Cloud Databases deployments. This action is called cryptoshredding. Deleting a key that is in use on your deployment locks the disks that contain your data and disables your deployment. You are still able to access the UI and some metadata such as security settings in the UI, CLI, and API but you are not able to access any of the databases or data that is contained within them. Key deletion is sent to the Activity Tracker as hs-crypto.secrets.delete.