Oracle Cloud Infrastructure Documentation

Using Your Own Encryption Key in OCI Database with PostgreSQL

Maintain control over your encryption keys by using your own key when running OCI Database with PostgreSQL.

To use this use your own encryption key with a database system, you must define a policy in the root compartment of your tenancy using the following examples:

ALLOW any-user TO use keys IN tenancy WHERE ANY {request.principal.type='postgresqldbsystem', request.principal.type='postgresqlbackup'}
ALLOW any-user TO use key-delegates in tenancy WHERE ANY {request.principal.type='postgresqldbsystem', request.principal.type='postgresqlbackup'}

Using Your Own Encryption when Creating a Database System

  1. Follow the workflow to create a database system as described in Creating a Database System.
  2. In the Configure database page of the workflow, find the Configure key management section and select Use customer-managed keys as the encryption key type. Enter the following information:
    • Vault compartment: Select the compartment containing the vault with the encryption key you want from the list.
    • Vault: Select the vault containing the encryption key you want from the list.
    • Master encryption key compartment: The master encryption key compartment is the same as the one you chose for the vault.
    • Master encryption key: Select the master encryption key you want from the list.
  3. Continue with the creation of the database system.
In the details page for the database system under General information, the Encryption key value is the encryption key you selected.

Changing the Encryption Key for an Existing Database System

You can change the encryption key used by a database system. The new encryption key must also reside in a vault you can access.
  1. Open the details page of the database system whose you want to change. For more information, see Getting a Database System's Details.
  2. Select one of the following encryption key options:
    • Use Oracle-managed keys: Select to have Oracle handle all encryption requirements.
    • Use customer-managed keys: Enter the following information:
      • Vault compartment: Select the compartment containing the vault with the key you want from the list.
      • Vault: Select the vault containing the key you want from the list.
      • Master encryption key compartment: The master key compartment is the same as the one you chose for the vault.
      • Master encryption key: Select the master encryption key you want from the list.
  3. Select Update.
The Encryption key entry in the database system;s details page now displays the updated encryption key.

Disabling and Reenabling a Database System's Encryption Key

You can disable a database system's encryption key. When the encryption key is disabled, the database system becomes inactive within an hour.
  1. Open the details page of the database system whose key you want to disable. For more information, see Getting a Database System's Details.
  2. Find the Encryption key entry and select the key.
    The Key information panel opens.
  3. From the Actions menu, select Disable.
After the database system becomes inactive, the encryption key is listed as Disabled in the Key information panel.

To reenable a disabled encryption key, following same steps and select Enable from the Actions menu.

You must restart the database system using the CLI after reenabling its encryption key. You can restart the database system immediately after reenabling the encryption key.

Using Your Own Encryption Key with Database System Backups

Backups automatically retain the encryption key from the database system from which they were created. The encryption key used is displayed in the backup's details page for Encryption key. You can't change the encryption key of a backup.

When you restore a database system from a backup, the restored database system retains the same encryption key used in the backup. After the restoration is complete, you can change the encryption key of the restored database system.

If you're creating a new database system from a backup, you can add or update an encryption key. For more information, see Creating a Database System from a Backup.