Robert Main
18f469105c
* Update website folder to indicate deprecation Adds an alert banner to the top of all MDX files within `/website` to indicate deprecation * Update website README
39 lines
1.7 KiB
Plaintext
39 lines
1.7 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: AEAD KMS configuration
|
|
description: >-
|
|
Learn about using the Authenticated Encryption with Associated Data (AEAD) KMS for key management. AEAD is typically used for development workflows or testing.
|
|
---
|
|
|
|
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
|
|
> [!IMPORTANT]
|
|
> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com.
|
|
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
|
|
|
|
# `aead` KMS
|
|
|
|
~> **Note:** This is mostly used for `dev` workflows or testing. The key will be exposed
|
|
to anyone that can view the configuration file. If using this KMS, consider
|
|
using `boundary config encrypt` to encrypt all but the `config` KMS and using an
|
|
external KMS for `config` purposes.
|
|
|
|
```hcl
|
|
kms "aead" {
|
|
purpose = "worker-auth"
|
|
aead_type = "aes-gcm"
|
|
key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
|
|
key_id = "global_worker-auth"
|
|
}
|
|
```
|
|
|
|
- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`,
|
|
`root`, `previous-root`, `recovery`, `bsr`, or `config`.
|
|
|
|
- `aead_type` - The type of encryption this KMS uses. Currently only `aes-gcm` is implemented.
|
|
|
|
- `key` - The base64-encoded 256-bit encryption key.
|
|
|
|
- `key_id` - The unique name of this key.
|
|
It is used to identify the key when you perform a root key migration.
|
|
You can use the `key_id` field with all KMS stanzas.
|