--- name: openpages-byok_ibmcloud title: Customer-managed encryption key configuration guide description: This document provides instructions for configuring customer-managed encryption keys using IBM Key Protect for IBM OpenPages application provisioning. last-updated: '' --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/openpages?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Customer-managed encryption key configuration guide This document provides instructions for configuring customer-managed encryption keys using IBM Key Protect for IBM OpenPages application provisioning. --- ## Prerequisites: Information required from IBM OpenPages Before starting the configuration, you will need the following values: | Item | Description | Value | |------|-------------|-------| | IBM OpenPages service ID | Service identifier for IBM OpenPages trusted profile configuration | `ServiceId-423b717e-9a51-4033-a663-961285fb8716` | | IBM OpenPages account ID | Account identifier for IBM OpenPages service-to-service authorizations | `c4cf7573920c4b98b883fb63ab00b556` | --- ## Architecture overview The custom encryption key implementation uses: - IBM Key Protect: Customer-managed encryption key service - Trusted profile: Secure identity federation between customer and IBM accounts - Service-to-service authorization: Controlled access for IBM Cloud services (IBM Db2 SaaS, IBM Cloud Object Storage) --- ## Section A: Customer-side configuration ### Step 1: Create IBM Key Protect service instance Create an IBM Key Protect service instance via IBM Cloud catalog. The encryption key can be in a different region than where your IBM OpenPages application will be provisioned. --- ### Step 2: Create encryption key Create a root key in your IBM Key Protect instance and capture the key CRN for provisioning. **Key CRN Format:** ``` crn:v1:bluemix:public:kms::a/::key: ``` --- ### Step 3: Create trusted profile Create a trusted profile in Cloud Identity and Access Management → Trusted profiles to establish secure access between your account and IBM OpenPages services. Configure the following: - Establish trust with service ID (refer to Prerequisites table for the IBM OpenPages service ID value) - Assign access policy to IBM Key Protect service with Reader and ReaderPlus roles for your encryption key Capture the profile ID for provisioning. **Profile ID Format:** ``` Profile- ``` --- ### Step 4: Configure service-to-service authorizations Configure authorizations in Cloud Identity and Access Management → Authorizations to grant IBM Cloud services access to your IBM Key Protect instance. #### 4.1 IBM Db2 SaaS to IBM Key Protect authorization Configure the following: - Source service: IBM Db2 SaaS - Source account: Refer to Prerequisites table for the IBM OpenPages account ID value - Target service: IBM Key Protect (your instance) - Roles: Reader, Authorization Delegator #### 4.2 IBM Cloud Object Storage to IBM Key Protect authorization Configure the following: - Source service: IBM Cloud Object Storage - Source account: Refer to Prerequisites table for the IBM OpenPages account ID value - Target service: IBM Key Protect (your instance) - Roles: Reader --- ## Section B: Information required for IBM OpenPages application provisioning After completing the configuration, provide the following information when provisioning your IBM OpenPages application: ### Required fields in provisioning catalog | Field name | Description | Format | |------------|-------------|--------| | IBM Key Protect CRN | Specify your encryption key CRN to encrypt all data at rest using your own customer-managed key | `crn:v1:bluemix:public:kms::a/::key:` | | Cloud Identity and Access Management trusted profile ID | Trusted profile ID that grants access to your encryption key | `Profile-` | ### Example values **IBM Key Protect CRN:** ``` crn:v1:bluemix:public:kms:us-south:a/1234567890abcdef:a1b2c3d4-e5f6-7890-abcd-ef1234567890:key:9876543210fedcba ``` **Cloud Identity and Access Management trusted profile ID:** ``` Profile-1fd96a98-ffc2-4e11-92ab-fa1de563e19d ``` --- ## Section C: Key management best practices ### Key lifecycle management As the key owner, you are fully responsible for the lifecycle management of your encryption keys. This includes key rotation, monitoring, access control, and deletion policies. Any key lifecycle issues or risks are the customer's responsibility. {: important} ### Key rotation IBM Key Protect supports key rotation to enhance security: - Manual rotation: Rotate keys on-demand based on your security requirements - Rotation policy: Establish a key rotation schedule per your organization's security policies - IBM service compatibility: Key rotation does not impact IBM OpenPages services - Encryption and decryption operations continue without interruption using the new key version For detailed information on key rotation, see [IBM Key Protect key rotation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys&format=markdown). ### Key deletion Deleting an encryption key will make all encrypted data permanently inaccessible. This action is irreversible. {: .warning} - Never delete a key actively used by IBM OpenPages - IBM Cloud enforces a 30-day waiting period before deletion - Consider key disablement for temporary access revocation For more information, see [IBM Key Protect key deletion](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys&format=markdown) ## Additional resources - [IBM Key Protect](https://cloud.ibm.com/docs/key-protect?format=markdown) - [Cloud Identity and Access Management trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&format=markdown) - [Cloud Identity and Access Management service-to-service authorizations](https://cloud.ibm.com/docs/account?topic=account-serviceauth&format=markdown) ---