Hyper Protect Crypto Services integration

Creating or adding a key in Hyper Protect Crypto Services

Navigate to your instance of Hyper Protect Crypto Services and generate or enter a key.

Granting service authorization

Authorize Hyper Protect Crypto Services for use with Cloud Databases deployments:

1. Open your IBM Cloud dashboard.
2. From the menu bar, click Manage > Access (IAM).
3. In the side navigation, click Authorizations.
4. Click Create.
5. In the Source service menu, select the service of the deployment. For example, Databases for PostgreSQL or Messages for RabbitMQ
6. In the Source service instance menu, select All instances.
7. In the Target service menu, select HPCS.
8. Select or retain the default value Account as the resource group for the Target Service
9. In the Target service Instance ID menu, select the service instances to authorize.
10. Enable the Reader role.
11. Click Authorize.

If the service authorization is not present before provisioning your deployment with a key, the provision fails.

Using the HPCS key

After you grant your Cloud Databases deployments permission to use your keys, you supply the key name or CRN when you provision a deployment. The deployment uses your encryption key to encrypt your data.

If provisioning from the catalog page, select the HPCS instance and key from the drop-down menu.

In the CLI, use the disk_encryption_key_crn parameter in the parameter's JSON object.

ibmcloud resource service-instance-create <INSTANCE_NAME> <SERVICE-NAME> standard us-south \
-p \ '{
  "disk_encryption_key_crn": "crn:v1:<...>:key:<id>"
}'

In the API, use the disk-encryption-key parameter in the body of the request.

curl -X POST \
  https://resource-controller.cloud.ibm.com/v2/resource_instances \
  -H 'Authorization: Bearer <>' \
  -H 'Content-Type: application/json' \
    -d '{
    "name": "my-instance",
    "target": "blue-us-south",
    "resource_group": "5g9f447903254bb58972a2f3f5a4c711",
    "resource_plan_id": "databases-for-x-standard",
    "disk_encryption_key_crn": "crn:v1:<...>:key:<id>"
  }'

If you provision a deployment through the CLI or API, the HPCS key must be identified by its full CRN, not just its ID. An HPCS CRN has the format crn:v1:<...>:key:<id>.

Using the HPCS key for backup encryption

This feature is only supported in the eu-es and br-sao regions. Encrypting backups with HPCS in a single region renders the backups inaccessible, if availability of HPCS is disrupted in this region. Taking a backup and restoring from backups will fail for the period that HPCS is unavailable. Therefore, encrypting backups with HPCS is not recommended. Use IBM® Key Protect to encrypt backups.

If you encrypted the backup with HPCS, encrypt the disk also with HPCS.

After you grant your Cloud Databases deployments permission to use your keys, you supply the key name or CRN when you provision a deployment. The deployment uses your encryption key to encrypt your data.

If you provision from the Catalog, select the HPCS instance and key from the drop-down menu.

In the CLI, use the backup_encryption_key_crn parameter in the parameter's JSON object.

ibmcloud resource service-instance-create <INSTANCE_NAME> <SERVICE-NAME> standard eu-es \
-p \ '{
  "backup_encryption_key_crn": "crn:v1:<...>:key:<id>"
}'

In the API, use the backup-encryption-key parameter in the body of the request.

curl -X POST \
  https://resource-controller.cloud.ibm.com/v2/resource_instances \
  -H 'Authorization: Bearer <>' \
  -H 'Content-Type: application/json' \
    -d '{
    "name": "my-instance",
    "target": "blue-us-south",
    "resource_group": "5g9f447903254bb58972a2f3f5a4c711",
    "resource_plan_id": "databases-for-x-standard",
    "parameters": {
      "backup_encryption_key_crn": "crn:v1:<...>:key:<id>"
    }
  }'

If you provision a deployment through the CLI or API, the HPCS key must be identified by its full CRN, not just its ID. An HPCS CRN has the format crn:v1:<...>:key:<id>.

Key rotation

HPCS offers manual and automatic key rotation and key rotation is supported by Cloud Databases deployments. When you rotate a key, the process initiates a Syncing KMS state task, and your deployment is reencrypted with the new key. The task is displayed on the Tasks panel on your deployment's Overview and the associated HPCS and Cloud Databases events are sent to Activity Tracker.

Deleting the deployment

If you delete a deployment that is protected with an HPCS key, the deployment remains registered against the key during the soft-deletion period (up to 9 days). If you need to delete the key in the soft-deletion period, you must force delete the key. After the soft-deletion period, the key can be deleted without the force. You can check the association between the key and your deployment to determine when you can delete the key.

Cryptoshredding

Cryptoshredding is a destructive action. When the key is deleted, your data is unrecoverable.

Hyper Protect Crypto Services enables initiation of a force delete of a key that is in use by IBM Cloud® services, including your Cloud Databases deployments. This action is called cryptoshredding. Deleting a key that is in use on your deployment locks the disks that contain your data and disables your deployment. You are still able to access the UI and some metadata such as security settings in the UI, CLI, and API but you are not able to access any of the databases or data that is contained within them. Key deletion is sent to the Activity Tracker Event Routing as hs-crypto.secrets.delete.

Migrating from Hyper Protect Crypto Services (HPCS) to Key Protect Dedicated (KP-ST)

During the migration from Hyper Protect Crypto Services (HPCS) to Key Protect Dedicated (KP‑ST), the following occurs:

• Your root key moves from Hyper Protect Crypto Services to Key Protect Dedicated.
• Existing data encryption keys (DEKs) are securely re‑wrapped.
• Encrypted data is not re‑encrypted or moved.
• Service availability is maintained.