Amazon Secrets Manager Cipher Stream Provider

Note: this component is designated "advanced", which means that objects of this type are not expected to be created or altered in most environments. If you believe that such a change is necessary, you may want to contact support in order to understand the potential impact of that change.

The Amazon Secrets Manager Cipher Stream Provider is used to create a cipher stream provider that uses a passphrase obtained from the Amazon AWS Secrets Manager service to generate the encryption key for protecting the contents of the encryption settings database. It may only be used with string secrets (in which the Secrets Manager service returns the secret in the form of a JSON object) and not with secrets stored in a binary form.

When starting up, this cipher stream provider will check for the existence of the file specified by the encryption-metadata-file configuration property. If that file does not exist, then the provider will generate it with a set of metadata to use when deriving an encryption key from the passphrase retrieved from the Secrets Manager service.
The next time the cipher stream provider is started, that metadata file will be read and used in conjunction with the passphrase retrieved from the Secrets Manager service to derive the key needed to decrypt the contents of the encryption settings database.
Once it is created, this Amazon Secrets Manager Cipher Stream Provider should not be altered in any way. If you would like to change the cipher stream provider that the server uses, even to use a different secret (or a different version of the same secret) from the AWS Secrets Manager, you will need to create a new cipher stream provider configuration object and update the global configuration to activate that new provider. If this is done with the server online, then the encryption settings database will automatically be re-encrypted with the new cipher stream provider. However, as a safeguard against unexpected failures, it is still recommended that you export the encryption settings definitions before switching the active cipher stream provider.

dsconfig Usage

To list the configured Cipher Stream Providers:

dsconfig list-cipher-stream-providers
     [--property {propertyName}] ...

To view the configuration for an existing Cipher Stream Provider:

dsconfig get-cipher-stream-provider-prop
     --provider-name {name}
     [--tab-delimited]
     [--script-friendly]
     [--property {propertyName}] ...

To update the configuration for an existing Cipher Stream Provider:

dsconfig set-cipher-stream-provider-prop
     --provider-name {name}
     (--set|--add|--remove) {propertyName}:{propertyValue}
     [(--set|--add|--remove) {propertyName}:{propertyValue}] ...

To create a new Amazon Secrets Manager Cipher Stream Provider:

dsconfig create-cipher-stream-provider
     --provider-name {name}
     --type amazon-secrets-manager
     --set enabled:{propertyValue}
     --set aws-external-server:{propertyValue}
     --set secret-id:{propertyValue}
     --set secret-field-name:{propertyValue}
     [--set {propertyName}:{propertyValue}] ...

To delete an existing Cipher Stream Provider:

dsconfig delete-cipher-stream-provider
     --provider-name {name}