Use Customer-Managed Encryption Keys (CMEK) at Rest

You must have the Organization Owner role to create, rotate, and delete customer-managed encryption keys. The Project Creator and Organization Owner roles can associate a key with a cluster. All organization members can retrieve the list of keys in an organization and view the details of a key.

You have a Management API key with the Organization Owner role.

You have deployed a cluster with AWS as your cloud service provider or enabled CMEK for AWS in your organization.

You have:

You must have the Organization Owner role to create, rotate, and delete customer-managed encryption keys. The Project Creator and Organization Owner roles can associate a key with a cluster. All organization members can retrieve the list of keys in an organization and view the details of a key.

You have a Management API key with the Organization Owner role.

You have deployed a cluster with GCP as your cloud service provider or enabled CMEK for GCP in your organization.

You have:

You must have the Organization Owner role to create, rotate, and delete customer-managed encryption keys. The Project Creator and Organization Owner roles can associate a key with a cluster. All organization members can retrieve the list of keys in an organization and view the details of a key.

You have a Management API key with the Organization Owner role.

You have enabled CMEK for Azure within your organization.

You have:

$ORGID is the organization ID.

$TOKEN is the API key token.

curl --request POST \
  --url "https://cloudapi.cloud.couchbase.com/v4/organizations/$ORGID/cmek/providers" \
  --header "Authorization: Bearer $TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
    "cloudProvider": "aws"
  }'

$ORGID is the organization ID.

$TOKEN is the API key token.

curl --request POST \
  --url "https://cloudapi.cloud.couchbase.com/v4/organizations/$ORGID/cmek/providers" \
  --header "Authorization: Bearer $TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
    "cloudProvider": "gcp"
  }'

$ORGID is the organization ID.

$TOKEN is the API key token.

$ARN is the Amazon Resource Name (ARN) of the KMS encryption key.

$CMEKID is the Capella ID of the customer-managed encryption key.

curl --request POST \
  --url "https://cloudapi.cloud.couchbase.com/v4/organizations/$organizationId/cmek" \
  --header "Authorization: Bearer $apiKeySecret" \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "Key name",
  "description": "Description of the key",
  "config": {
	  "arn": "$ARN"
	  }
  }'

{
    "id": "$cmekId"
}

$ORGID is the organization ID.

$TOKEN is the API key token.

$RESOURCE_NAME is the Key Version Resource ID of your GCP KMS encryption key.

$CMEKID is the Capella ID of the customer-managed encryption key.

curl --request POST \
  --url "https://cloudapi.cloud.couchbase.com/v4/organizations/$ORGID/cmek" \
  --header "Authorization: Bearer $TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "Key name",
  "description": "Description of the key",
  "config": {
	  "resourceName": "$RESOURCE_NAME"
	  }
  }'

{
    "id": "$CMEKID"
}

$ORGID is the organization ID.

$TOKEN is the API key token.

$VAULT_URI is your vault or managed HSM URI, which you can view when you create a new key vault or on the Azure Portal. Your URI must include your key name and key version.

$CMEKID is the Capella ID of the customer-managed encryption key.

curl --request POST \
  --url "https://cloudapi.cloud.couchbase.com/v4/organizations/$ORGID/cmek" \
  --header "Authorization: Bearer $TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "Key name",
  "description": "Description of the key",
  "config": {
	  "keyLocation": "$VAULT_URI",
    "region": "eastus"
	  }
  }'

{
    "id": "$CMEKID"
}