Open benesch opened 7 months ago
A few thoughts that might help future work on CMEK...
For implementation, I imagine all the work can be pushed down into persist. A few possible ideas there:
EncryptedBlob
and EncryptedConsensus
implementations, that sit as the lowest level of the chain. They transparently add in encryption of the data / data keys, and are given a client that allows them to decrypt the data keys via customer-managed key if available.Alternatively, we could rejig our cloud infra to be single tenant and do something super simple:
Notion epic
Link: https://www.notion.so/Customer-Managed-Encryption-Keys-CMEK-96457aba99a743f98c170fc29ec4ddc6 Product brief: Status: Not started Prioritization: 10 - October Estimated delivery date:
Migrated from MaterializeInc/product#221.
A user in the community asked about our support for CMEK for encryption at rest, and mentioned it as a blocker for their use case. Their specific need was for keys stored in AWS-KMS.
See this thread for more context.
cc @morsapaes