GUIDES · SECURE

Customer-managed keys in production.

Bring your own keys without locking yourself out. With a customer-managed key, threatDefendr can run compute on your data while never holding a key it could export — and the grant stays narrow enough that you keep full control.

13 min read Advanced By K. Singh

Envelope encryption

Storage is envelope-encrypted. Data keys are generated locally and wrapped by your CMK; the platform decrypts a data key only in memory, only to read a block, and never persists or exports key material.

Grant the data plane

Give the data-plane role exactly the three KMS actions envelope encryption needs — encrypt, decrypt, and generate-data-key — and nothing more.

JSONkms key policy (statement)
{
  "Sid": "AllowDataPlaneEnvelopeEncryption",
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::ACCT:role/td-dataplane" },
  "Action": ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey"],
  "Resource": "*"
}

Rotate & break-glass

Enable automatic CMK rotation — envelope encryption means re-wrapping data keys, not re-encrypting petabytes, so rotation is cheap. Keep a separate key administrator so you are never one revoked grant away from locked-out storage.

Never the sole holder of the only path in. Scheduling the CMK for deletion or revoking the data-plane grant makes the cell’s storage unreadable — including to you. Retain a break-glass key admin and an alias, and rehearse rotation in staging before production. See BYOC deployment.

Where to go next

Security model — key management end to end.
Trust center — attestations and controls.

← PREV Scoped tokens ALL GUIDES → Browse all guides