About Self-Managed Vault Keys

Available for AWS and GCP vaults.

This article contrasts how Eon-managed keys and self-managed keys encrypt data in your vaults, and explains how to enable restoring from vaults that use self-managed keys.

By using self-managed vault keys, you assume responsibility for securing against unauthorized access and accidental deletion. If a key is deleted, any snapshots encrypted with it will be unretrievable.

Comparison of Eon-managed and self-managed keys

By default, Eon encrypts your snapshots using a key from your vault account. Using the Eon-managed key offers several benefits:

The vault is air-gapped and locked down from any cloud accounts you own, so bad actors can’t access the key if your accounts are compromised.
The key can’t be accidentally or maliciously deleted and cause your company to lose all access to your snapshots.
The key is automatically rotated at regular intervals.
You don’t need to create and manage access to the key.
Eon manages access to the vault and allows temporary access to a restore account only during restore operations. With self-managed keys, you need to manually enable access for the restore account before any restore operation, and remove it after the restore.

However, if your requirements are such that you need to manage the encryption key yourself, you can create a customer-managed key in AWS KMS or GCP Cloud KMS and grant access to your vault account. Note that self-managed keys require more heavy lifting and careful management on your part.

Best practices

Use self-managed keys only if your company specifically requires it. For most companies, an Eon-managed key offers better security.
Use a key from a dedicated AWS account or GCP project where identities have limited access and minimal permissions.
Although you can use an existing key, we recommend using a dedicated key instead.

Enable restoring with a self-managed key

By default, a self-managed key doesn’t grant access to other accounts, which blocks you from restoring or querying snapshots in the vault. To enable restoring and querying, you need to grant access to your restore accounts.

See how to update AWS vault keys

For AWS vaults with a self-managed KMS key, you need to update the key policy to grant access to your restore accounts.

When you create the vault, Eon provides key policy statements that allow the currently configured restore accounts to access the key. If you want to enable restoring to additional restore accounts, you can add them to the key policy.

To get the policy statements for your restore accounts:

In the Vaults page, open the vault that uses your self-managed key.
Click Get Suggested Policy to see the key policy statements for all currently connected restore accounts.
Add the policy statements to your KMS key policy in the AWS console.

When you add or remove restore accounts, repeat this process to update the key policy with the current restore accounts.

See how to update GCP vault keys

For GCP vaults with a self-managed Cloud KMS key, you need to grant IAM permissions on the key to your restore accounts.

GCP uses IAM bindings on the key. You run gcloud commands to grant the necessary IAM roles to each restore account’s service account.

To get the commands for your restore accounts:

In the Vaults page, open the vault that uses your self-managed key.
Click Get Suggested Permissions to see the gcloud commands for all currently connected restore accounts.
Run the commands in your terminal to grant the necessary permissions.

When you add or remove restore accounts, repeat this process to update the permissions for the current restore accounts.

When you remove a restore account from your Eon configuration, remember to revoke its access to the key. Otherwise, the removed account will retain the ability to decrypt your vault snapshots.