cmek edits #414
cmek edits #414
Conversation
| It is best practice to use the same CMK key as the instance it’s being cloned from. | ||
| You can override this to use another CMK key - but you can not use the Neo4j Managed Key. | ||
|
|
||
| === Detach a CMK from Aura |
There was a problem hiding this comment.
I find "remove" clearer than "detach" but thats just my opinion and I dont feel strongly. So feel free to leave as is.
| When using Customer Managed Keys, you give Aura permission to encrypt and decrypt using the key, but Aura has no access to the key’s material. | ||
| Aura has no control over the availability of your externally managed key in the KMS. | ||
| If you lose keys that are managed outside of Aura, Aura can’t recover your data. | ||
| If you lose keys that are managed outside of Aura in the cloud provider's KMS, you will not be able to access the data. |
There was a problem hiding this comment.
I would remove the "that are managed outside of Aura" here. Its a bit confusing, since all keys are managed in the Cloud Provider KMS. So it would be
If you lose keys in the cloud provider's KMS, you ...
| A Customer Managed Key (CMK) gives you more control over key operations than the standard Neo4j encryption. | ||
| These are created and managed using a supported cloud key management service (KMS). | ||
| Externally, Customer Managed Keys are also known as Customer Managed Encryption Keys (CMEK). | ||
|
|
||
| When using a Customer Managed Key, all data at rest is encrypted with the key. | ||
| Customer Managed Keys are supported for v4.x and v5.x instances. | ||
|
|
||
| Customer Managed Keys are designed to stay within the cloud provider’s KMS to maintain their security. |
There was a problem hiding this comment.
Tbh I am not sure what this sentence is supposed to explain. "are designed" sounds like we in Aura designed it this way? I think I would remove this unless there is some specific information you want to convey,
|
Thanks for the documentation updates. The preview documentation has now been torn down - reopening this PR will republish it. |
add info about regions, deleting a key in aura, keeping a key in a cloud provider's kms to maintain security, removed "unrecoverable" and replaced with softer language,