KMS Keys

Use KMS keys for resource encryption

DuploCloud allows you to configure Tenant and Plan level KMS (Key Management Service) keys for AWS/Azure resources. These keys can be selected when creating supported resources to ensure consistent encryption and help meet compliance requirements.

Adding a KMS Key for a Plan

Plan-level KMS keys can be used for encrypting resources in any Tenant under the selected Plan.

1. Navigate to Administrator -> Plans.

2. Select the Plan from the NAME column.

3. Select the KMS tab.

4. Click Add. The Add a Kms Key pane displays.

   

   Add a Kms Key pane
5. Complete the following fields:

Key Name	Enter a friendly name for the key (e.g., test-key)
Key Id	Enter the cloud provider–specific key ID (AWS KMS Key ID or Azure Key Vault Key ID).
Key Arn	Enter the cloud provider–specific key ARN or resource ID. For AWS this is the KMS Key ARN; for Azure, this is the Key Vault Key ID URI.

1. Click Submit to add the key to the Plan. Once added, the key can be selected when creating supported resources in the Plan, such as databases, compute instances, storage resources, and other services.

Plan KMS tab in the DuploCloud Portal

Adding a KMS Key for a Tenant

Tenant-level KMS keys can be used for encrypting resources only within the selected tenant.

1. Navigate to Administrator -> Tenants.

2. Select the Tenant from the NAME column.

3. Select the KMS tab.

4. Click Add. The Add a Kms Key pane displays.

   

   Add a Kms Key pane
5. Complete the following fields:

Key Name	Enter a friendly name for the key (e.g., test-key)
Key Id	Enter the cloud provider–specific key ID (AWS KMS Key ID or Azure Key Vault Key ID).
Key Arn	Enter the cloud provider–specific key ARN or resource ID. For AWS this is the KMS Key ARN; for Azure, this is the Key Vault Key ID URI.

1. Click Submit to add the key to the Tenant. Once added, the key can be selected when creating supported resources in the Tenant.

Tenant KMS tab in the DuploCloud Portal

Selecting a KMS Key When Creating Resources

When creating a Host, RDS database, or other supported resource, select a KMS key to use for encrypting data at rest.

1. Navigate to the resource creation page (e.g., Hosts, RDS, or other supported resources).

2. Locate the Encryption Key or KMS Key field.

3. Choose a key from the options listed under Default Tenant Key, Plan-level Keys, or Tenant-level Keys.

   

   Encryption Key selection options
4. Complete the rest of the resource creation steps as usual.

Note: Only applicable resources will display these key options. Unsupported resources will continue to use the default tenant key.