---
title: Encryption At Rest
description: Understand encryption at rest in Couchbase Server and how to
  configure it using the Autonomous Operator.
pubDate: 2026-08-17T09:53:44.266Z
antora:
  editUrl: https://github.com/couchbase/docs-operator/edit/release/2.9/modules/ROOT/pages/concept-encryption-at-rest.adoc
  xref: xref:operator::concept-encryption-at-rest.adoc[]
---

[Consult the llms.txt file for a full list of contents](/llms.txt)
[View original HTML](/operator/current/concept-encryption-at-rest.html)

# Encryption At Rest

> Understand encryption at rest in Couchbase Server and how to configure it using the Autonomous Operator. 

## [](#overview)Overview

Encryption at rest is a security feature introduced in Couchbase Server 8.0.0 that protects your data by encrypting it on disk. When enabled, sensitive data stored on the Couchbase nodes is encrypted, ensuring that even if the underlying storage is compromised, the data remains secure.

## [](#what-data-can-be-encrypted)What Data Can Be Encrypted?

Encryption at rest supports encrypting multiple types of data within your Couchbase deployment:

* **Data in buckets** \- The actual documents and data stored in your buckets
* **Cluster configuration** \- Sensitive cluster settings and configurations
* **Logs** \- Server log files (note: encrypting logs will break fluent-bit log streaming)
* **Audit logs** \- Security audit trail data

> [!NOTE]
> Field-Level Encryption in Applications
> 
> Applications can use the SDK to encrypt specific fields. Depending on your application's requirements, field-level encryption may be more appropriate than encrypting the entire bucket. See the SDK documentation for your development language for more information. For example:
> 
> * Go SDK: [Encrypting Your Data](../../go-sdk/current/howtos/encrypting-using-sdk.md)
> * Java SDK: [Encrypting Your Data](../../java-sdk/current/howtos/encrypting-using-sdk.md)
> * Python SDK: [Encrypting Your Data](../../python-sdk/current/howtos/encrypting-using-sdk.md)

## [](#key-types)Key Types

Couchbase offers flexibility in how encryption keys are managed through three different key types:

### [](#couchbase-server-managed-keys)Couchbase Server Managed Keys

Also called AutoGenerated keys, these are the simplest option. Couchbase Server automatically generates and manages these keys without requiring external services. This is ideal for:

* Environments without external key management infrastructure
* Use cases where key management can be handled within Couchbase

### [](#aws-kms-keys)AWS KMS Keys

AWS Key Management Service (KMS) integration allows you to use AWS-managed encryption keys. This is recommended when:

* Running Couchbase in AWS (EKS or EC2)
* Your organization uses AWS KMS for centralized key management
* You need compliance with AWS security standards

### [](#kmip-keys)KMIP Keys

Key Management Interoperability Protocol (KMIP) is an industry standard that works with enterprise key management systems from vendors like Thales, IBM, or HashiCorp Vault. Choose KMIP when:

* You have an existing enterprise key management system
* You need vendor-neutral key management
* Compliance requires external key management

## [](#key-concepts)Key Concepts

### [](#key-encryption-keys-kek-and-data-encryption-keys-dek)Key Encryption Keys (KEK) and Data Encryption Keys (DEK)

Couchbase uses a two-tier key hierarchy:

* **Key Encryption Keys (KEK)** \- The master keys you define through `CouchbaseEncryptionKey` resources. These encrypt other keys or data.
* **Data Encryption Keys (DEK)** \- Temporary keys generated by Couchbase to encrypt actual data. These are encrypted by KEKs.

### [](#key-rotation)Key Rotation

Key rotation is an important security practice. With encryption at rest:

* KEK rotation can be scheduled through the `CouchbaseEncryptionKey` resource
* DEK rotation happens automatically based on the `rotationInterval` setting
* When a key rotates, new data is encrypted with the new key while old data remains accessible

### [](#key-usage-restrictions)Key Usage Restrictions

You can restrict what each key encrypts by setting usage parameters:

* `configuration` \- Cluster configuration data
* `key` \- Other encryption keys
* `log` \- Log files
* `audit` \- Audit logs
* `allBuckets` \- All bucket data

By default, keys can encrypt anything. Restricting usage improves security through separation of concerns.

## [](#how-to-enable-encryption-at-rest)How to Enable Encryption At Rest

Enabling encryption at rest with the Autonomous Operator involves three main steps:

### [](#step-1-enable-encryption-management)Step 1: Enable Encryption Management

First, enable encryption at rest management on your `CouchbaseCluster` resource:

```yaml
apiVersion: couchbase.com/v2
kind: CouchbaseCluster
metadata:
  name: my-cluster
spec:
  security:
    encryptionAtRest:
      managed: true
```

### [](#step-2-create-encryption-keys)Step 2: Create Encryption Keys

Create one or more `CouchbaseEncryptionKey` resources. Here's a simple example with an auto-generated key:

```yaml
apiVersion: couchbase.com/v2
kind: CouchbaseEncryptionKey
metadata:
  name: my-key
spec:
  keyType: AutoGenerated
```

For AWS KMS or KMIP keys, additional configuration is required (see [Couchbase Encryption At Rest](tutorial-encryption-at-rest.md)).

### [](#step-3-apply-encryption-to-data)Step 3: Apply Encryption to Data

Configure which data should be encrypted on your cluster or buckets:

```yaml
apiVersion: couchbase.com/v2
kind: CouchbaseCluster
metadata:
  name: my-cluster
spec:
  security:
    encryptionAtRest:
      managed: true
      configuration:
        enabled: true
        keyName: "my-key"
      audit:
        enabled: true
        keyName: "my-key"
```

For bucket-level encryption:

```yaml
apiVersion: couchbase.com/v2
kind: CouchbaseBucket
metadata:
  name: secure-bucket
spec:
  name: secure-bucket
  memoryQuota: 512Mi
  encryptionAtRest:
    keyName: "my-key"
```

## [](#security-considerations)Security Considerations

When implementing encryption at rest:

* **Key Protection** \- Consider encrypting your data keys with a dedicated Key Encryption Key (KEK) rather than using the cluster master password
* **Key Rotation** \- Implement regular key rotation schedules appropriate for your security requirements
* **External Key Management** \- For sensitive environments, consider using AWS KMS or KMIP instead of auto-generated keys
* **Log Encryption Trade-offs** \- Be aware that encrypting logs prevents log streaming to monitoring systems

## [](#next-steps)Next Steps

For detailed configuration instructions and advanced features, see:

* [How to Configure Encryption At Rest](tutorial-encryption-at-rest.md) \- Complete configuration guide with all options

## [](#related-information)Related Information

* [Security Concepts](#concept-security.adoc)
* [Managing Buckets](#howto-manage-buckets.adoc)
* [Managing Clusters](#howto-manage-cluster.adoc)