topic Re: CMK for managed services automatic rotation in Data Engineering

CMK for managed services automatic rotation

Constantino — Thu, 03 Nov 2022 16:39:02 GMT

The docs for the CMK for workspace storage states:

After you add a customer-managed key for storage, you cannot later rotate the key by setting a different key ARN for the workspace. However, AWS provides automatic CMK master key rotation, which rotates the underlying key without changing the key ARN as described in AWS docs. Automatic CMK master key rotation is compatible with Databricks customer-managed keys for storage.

However the docs for managed services does not make any mention automatic CMK master key rotation - does CMK for managed services support this AWS automation?

Re: CMK for managed services automatic rotation

Constantino — Fri, 04 Nov 2022 13:05:54 GMT

yep, I'm aware of manual key rotation, but I'd like to explicitly avoid it because:

it requires we take down our clusters (not feasible for our reporting clusters)
it means we have to add extra infra to our terraform to execute the rotation (feels needless if AWS can already rotate them automatically)

Re: CMK for managed services automatic rotation

Debayan — Fri, 04 Nov 2022 07:17:18 GMT

Hi @Constantino Schillebeeckx , You can update/rotate CMK at a later time (on a running workspace). Please refer: https://docs.databricks.com/security/keys/customer-managed-keys-managed-services-aws.html?_ga=2.214562071.1895504292.1667411694-643525343.1663499643#add-or-update-a-customer-managed-key-on-a-running-workspace