Key Protect integration

Granting service authorization in the UI

Authorize Key Protect for use with Cloud Databases deployments:

1. Open your IBM Cloud dashboard.
2. From the menu bar, click Manage -> Access (IAM).
3. In the side navigation, click Authorizations.
4. Click Create.
5. In the Source service menu, select the service of the deployment. For example, Databases for PostgreSQL or Databases for MongoDB.
6. In the Source service resources menu, select All resources.
7. In the Target service menu, select Key Protect.
8. Select or retain the default value Account as the resource group for the Target Service
9. In the Target service Instance ID menu, select the service instances to authorize.
10. Enable the Reader role.
11. To use "Bring your own key" (BYOK), Select the Enable authorizations to be delegated box in the Authorize dependent services section.
12. Click Authorize.

If the service authorization is not present before provisioning your deployment with a key, the provision fails.

If you want to set up a more restrictive authorization policy, configure your policy for an explicit root key CRN or for a specific Key Protect instance. Restrictions applied for Key Protect key rings are currently not supported.

Granting service authorization in the CLI

1. Create an authorization policy to allow the Cloud Databases service to access the Key Protect service instance on the CLI. For a full set of arguments, see the IAM CLI reference.

bx iam authorization-policy-create <SERVICE-NAME> kms "Reader,AuthorizationDelegator"

If the service authorization is not present before provisioning your deployment with a key, the provision fails.

If you want to set up a more restrictive authorization policy, configure your policy for an explicit root key CRN or for a specific Key Protect instance. Restrictions applied for Key Protect key rings are currently not supported.

Granting service authorization via the REST API

1. Create an authorization policy to allow the Cloud Databases service to access the Key Protect service instance via the IAM REST API.

For a full API reference, see the IAM Policy Management API.

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{
  "type": "authorization",
  "subjects": [
      {
          "attributes": [
              {
                  "name": "accountId",
                  "value": "CUSTOMER_ACCOUNT_ID"
              },
              {
                  "name": "serviceName",
                  "value": "<SERVICE-NAME>"
              }
          ]
      }
  ],
  "roles": [
      {
        "role_id": "crn:v1:bluemix:public:iam::::serviceRole:Reader"
      },
      {
        "role_id": "crn:v1:bluemix:public:iam::::role:AuthorizationDelegator"
      }
    ],
    "resources": [
        {
            "attributes": [
                {
                    "name": "accountId",
                    "operator": "stringEquals",
                    "value": "CUSTOMER_ACCOUNT_ID"
                },
                {
                    "name": "serviceName",
                    "operator": "stringEquals",
                    "value": "kms"
                }
            ]
        }
    ]
}'

If the service authorization is not present before provisioning your deployment with a key, the provision fails.

If you want to set up a more restrictive authorization policy, configure your policy for an explicit root key CRN or for a specific Key Protect instance. Restrictions applied for Key Protect key rings are currently not supported.

Using the Key Protect key in the UI at provision

If provisioning from the catalog page, select the Key Protect instance and key from the dropdown menu.

Using the Key Protect key in the CLI at provision

In the CLI, use the dataservices.encryption.disk parameter in the parameters JSON object to assign a root key CRN to your service instance.

ibmcloud resource service-instance-create <INSTANCE-NAME> <SERVICE-NAME> <PLAN-NAME> REGION -p '{"dataservices":{"encryption":{"disk":"KMS_KEY_CRN"}}}'

The Key Protect key needs to be identified by its full CRN, not just its ID. A Key Protect CRN is in the format crn:v1:<...>:key:<id>.

Using the Key Protect key in the API at provision

In the API, use the dataservices.encryption.disk parameter in the body of the request.

  curl -X POST https://resource-controller.cloud.ibm.com/v2/resource_instances -H "Authorization: Bearer <IAM token>" -H 'Content-Type: application/json' -d '{
    "name": "<INSTANCE-NAME>",
    "target": "ca-mon",
    "resource_group": "<A RESOURCE GROUP GUID>",
    "resource_plan_id": "<A PLAN ID>",
    "parameters": {
      "dataservices": {
          "encryption": {
            "disk": "KMS_KEY_CRN"
          }
      }
    }

The Key Protect key needs to be identified by its full CRN, not just its ID. A Key Protect CRN is in the format crn:v1:<...>:key:<id>.