Legacy encryption key support for when KMS is on#1223
Conversation
|
This seems like it adds complexity to the algorithms. Could we go straight KMS and get rid of this special use case? The only reason I ask is that we are early enough now that we could make a case with partners, etc. that we blow away the databases one last time before starting with KMS. I wanted to ask the question to make sure I was not missing anything. |
|
Fair question @jrminton. We need local encryption for environments w/o AWS KMS (like a local laptop install). The tagging of encryption keys also helps us future-proof beyond KMS. |
app/services/encrypted_key_maker.rb
Outdated
There was a problem hiding this comment.
Should we remove this Other key since it's not currently used?
|
For Enable KMS #189, all the accounts in all the envs will be toasted. All the UUIDs will change. Do we need to preserve them? |
pkarman
changed the title
There was a problem hiding this comment.
My first question when skimming this "XOR with what?". Should we specify it's 'KMSx' XOR '0000'
app/services/encrypted_key_maker.rb
Outdated
There was a problem hiding this comment.
Since there's only one value in KEY_TYPE for now, should we just make this KMS_KEY_TYPE = 'KMSx'? Or is this part of the plan to refactor EncryptedKeyMaker to allow locally-encrypted keys too?
There was a problem hiding this comment.
the latter. we wanted to provide structure for future refactor.
**Why**: Environments with existing encrypted accounts will fail to decrypt properly when KMS is turned on. This change prefixes the new KMS accounts with 'KMSx' flag so that they are recognizable beyond respecting the feature flag.
|
all ready @monfresh and @zachmargolis |
**Why**: Environments with existing encrypted accounts will fail to decrypt properly when KMS is turned on. This change prefixes the new KMS accounts with 'KMSx' flag so that they are recognizable beyond respecting the feature flag.
5 participants
Why: Environments with existing encrypted accounts will
fail to decrypt properly when KMS is turned on. This change
prefixes the new KMS accounts with 'KMSx' flag so that
they are recognizable beyond respecting the feature flag.