Vault-5619: Transit BYOK Documentation #15817
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
taoism4504
reviewed
Jun 6, 2022
| - `allow_rotation` `(bool: false)` - If set, the imported key can be rotated | ||
| within Vault by using the `rotate` endpoint. | ||
|
|
||
| **NOTE**: Once an imported key is rotated within Vault, it will no longer |
There was a problem hiding this comment.
Suggested change
| **NOTE**: Once an imported key is rotated within Vault, it will no longer | |
| ~> **Note:** Once an imported key is rotated within Vault, it will no longer |
taoism4504
reviewed
Jun 6, 2022
|
|
||
| This endpoint imports new key material into an existing imported key. | ||
|
|
||
| **Note**: Keys whose material was generated by Vault do not support |
There was a problem hiding this comment.
Suggested change
| **Note**: Keys whose material was generated by Vault do not support | |
| ~> **Note:** Keys whose material was generated by Vault do not support |
taoism4504
reviewed
Jun 6, 2022
| @@ -266,6 +416,10 @@ ciphertext to be encrypted with the latest version of the key, use the `rewrap` | |||
| endpoint. This is only supported with keys that support encryption and | |||
| decryption operations. | |||
|
|
|||
| **Note**: For imported keys, rotation is only supported if the | |||
There was a problem hiding this comment.
Suggested change
| **Note**: For imported keys, rotation is only supported if the | |
| ~> **Note:** For imported keys, rotation is only supported if the |
taoism4504
reviewed
Jun 6, 2022
| @@ -235,6 +235,58 @@ the proper permission, it can use this secrets engine. | |||
| data, since the process would not be able to get access to the plaintext | |||
| data. | |||
|
|
|||
| ## Bring Your Own Key (BYOK) | |||
|
|
|||
| *Note:* Key import functionality supports cases in which there is a need to bring | |||
There was a problem hiding this comment.
Suggested change
| *Note:* Key import functionality supports cases in which there is a need to bring | |
| ~> **Note:** Key import functionality supports cases in which there is a need to bring |
taoism4504
approved these changes
Jun 6, 2022
| provided AES key. The wrapped AES key should be the first 512 bytes of the | ||
| ciphertext, and the encrypted key material should be the remaining bytes. | ||
|
|
||
| - `hash_function` `(string: "SHA-256")` - The hash function used for the |
There was a problem hiding this comment.
Comparing against the code looks like we are expecting non-dashed versions of the hash function names such as SHA256...
Note the same issue exists below for the import version hash_function doc.
| This endpoint imports existing key material into a new transit-managed encryption key. | ||
| To import key material into an existing key, see the `import_version/` endpoint. | ||
|
|
||
| ### Parameters |
There was a problem hiding this comment.
I believe we are missing the context parameter.
stevendpclark
approved these changes
Jun 17, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Docs changes for Transit BYOK API endpoints and description for constructing the ciphertext for the key