IBM Cloud Docs
Key Protect integration

Key Protect integration

The data that you store in IBM® Db2® Warehouse on Cloud is encrypted by default using randomly generated keys. If you need to control the encryption keys, you can use IBM Key Protect to create, add, and manage encryption keys. Then, you can associate those keys with your Db2 Warehouse on Cloud deployment to encrypt your Db2 databases.

To get started, you need Key Protect provisioned on your IBM Cloud account.

Creating or adding a key in Key Protect

Navigate to your instance of Key Protect and generate or enter a key.

Granting service authorization

Authorize Key Protect for use with Db2 Warehouse on Cloud deployments:

  1. Open your IBM Cloud dashboard.
  2. From the menu bar, select Manage > Access (IAM).
  3. In the side navigation, select Authorizations. Click Create.
  4. In the Source service menu, select the service of the deployment. For example, Db2 Warehouse.
  5. In the Source service instance menu, select All service instances.
  6. In the Target service menu, select Key Protect.
  7. In the Target service instance menu, select the service instance to authorize.
  8. Enable the Reader role. Click Authorize.

Using the Key Protect key

After you grant your Db2 Warehouse instance permission to use your keys, you supply the Key Protect information on the Console Administration -> Security -> Manage Keys tab. You must provide the name of the Key Protect instance and the key that was created in the "Creating or adding a key in Key Protect" section. After the information is provided, you then migrate the instance to Key Protect managed keys.