Storage key

Everything Vigilfield writes for your organization is encrypted at rest with AWS KMS. You choose which key:

• Vigilfield-managed default. A per-organization KMS key that Vigilfield owns. This is what you get if you do nothing.
• Customer-managed. Your own KMS key, in an AWS account you own. Vigilfield uses it for server-side encryption (SSE-KMS) on every object it writes. It never handles the key material. Encryption and decryption happen inside AWS at the storage layer.

Vigilfield gets access to your key through a KMS grant. No secret is shared.

The page is under Administration, as Storage Key. Only admins can see or change it.

Requirements

• The key must be in us-east-1. For a multi-region key, use the ARN of its us-east-1 replica.
• The key ARN must look like arn:aws:kms:us-east-1:<account>:key/<id>.

Set a customer-managed key

1. Open Administration in the sidebar, then Storage Key.
2. Under Deployment documents, enter the AWS account ID that holds (or will hold) the key and click Show deployment documents.
3. Deploy the documents in the order shown, in that AWS account. Each has Copy and Download:
   1. Create the identity provider (once per account). Skip it if the page says the provider is already registered, or if CloudFormation reports that it already exists.
   2. Create the vf-storage-key role.
   3. Create the key, or update an existing key's policy. Use the CloudFormation template to create a new key, or add the key policy statement to a key you already have.
4. Under Set a customer-managed key, paste the KMS Key ARN and click Save key.

When you save, Vigilfield assumes the vf-storage-key role, creates a grant on the key, and writes and reads a test object under it. If any step fails, nothing changes and the error appears beside the button. Once it succeeds, Current key shows Customer-managed and the key ARN.

If you showed the documents for one account, the key ARN you save must be in that same account.

Saving the key that is already set changes nothing.

API: get the deployment documents, set the key, get the key.

Replace or clear the key

• Replace: paste a new ARN under Replace key and click Replace key.
• Clear: click Clear, then Clear key. Your organization goes back to the Vigilfield-managed default key.

API: clear the key.

Timing

Revoking Vigilfield's access, by clearing the key here or by revoking the grant on the key, takes effect within minutes, not instantly.