Amazon Key Management Service Cipher Stream Provider

Note: this component is designated "advanced", which means that objects of this type are not expected to be created or altered in most environments. If you believe that such a change is necessary, you may want to contact support in order to understand the potential impact of that change.

The Amazon Key Management Service Cipher Stream Provider is used to create a cipher stream provider using a secret key that is decrypted using the Amazon Key Management Service.

When starting up, this cipher stream provider will check for the existence of the file specified by the encrypted-password-file configuration property. If that file does not exist, then the provider will securely generate a very long password that it will use to generate a local encryption key to encrypt the contents of the encryption settings database. It will send that password, along with additional encryption metadata, to the Key Management Service, and that encrypted result will be written to the encrypted password file.
The next time the cipher stream provider is started, that encrypted password file will be read and its contents sent to the Key Management Service to be decrypted. The decrypted password and encryption metadata will be used to derive the secret key that will be used to decrypt the contents of the encryption settings database.
Once it is created, this Amazon Key Management Service Cipher Stream Provider should not be altered in any way. If you would like to change the cipher stream provider that the server uses, even to use a different key in the Amazon Key Management Service, you will need to create a new cipher stream provider configuration object and update the global configuration to activate that new provider. If this is done with the server online, then the encryption settings database will automatically be re-encrypted with the new cipher stream provider. However, as a safeguard against unexpected failures, it is still recommended that you export the encryption settings definitions before switching the active cipher stream provider.

dsconfig Usage

To list the configured Cipher Stream Providers:

dsconfig list-cipher-stream-providers
     [--property {propertyName}] ...

To view the configuration for an existing Cipher Stream Provider:

dsconfig get-cipher-stream-provider-prop
     --provider-name {name}
     [--tab-delimited]
     [--script-friendly]
     [--property {propertyName}] ...

To update the configuration for an existing Cipher Stream Provider:

dsconfig set-cipher-stream-provider-prop
     --provider-name {name}
     (--set|--add|--remove) {propertyName}:{propertyValue}
     [(--set|--add|--remove) {propertyName}:{propertyValue}] ...

To create a new Amazon Key Management Service Cipher Stream Provider:

dsconfig create-cipher-stream-provider
     --provider-name {name}
     --type amazon-key-management-service
     --set enabled:{propertyValue}
     --set kms-encryption-key-arn:{propertyValue}
     [--set {propertyName}:{propertyValue}] ...

To delete an existing Cipher Stream Provider:

dsconfig delete-cipher-stream-provider
     --provider-name {name}