Manage Vaults
Who can use this feature
Anyone with these permissions: Manage vaults (Cloud workloads, SaaS applications)
This article explains how to add a vault for your Eon snapshots.
Vaults are required for most backup policies. After you add the vault, you can set it as a destination for snapshots in your backup policies.
For AWS and GCP vaults, you can choose whether to encrypt your snapshots with an Eon-managed or self-managed vault key:
For Azure vaults, only the Eon-managed key is available.
Create a vault with an Eon-managed key
The Eon-managed key is recommended and provides several advantages, including air-gapped security, automatic rotation, and simplified management. You can create a vault that uses an Eon-managed vault key for AWS, Azure, or GCP vaults.
Before you start
After creation, only the vault name and display color can be changed. All other settings are permanent. Make sure you know, and double-check, the settings you need before creating the vault.
Set the vault configuration
-
In the Vaults page, click Create Vault. The Create vault panel opens.
-
Set the vault’s display name, cloud provider, region, and display color.
The vault is created. When configuring backup policies, you can now select the new vault as the destination for snapshots.
Create a vault with a self-managed key
If your requirements mandate more control over encryption keys, you can create an AWS or GCP vault that encrypts your snapshots with a self-managed KMS key. This requires additional setup and ongoing management.
By using self-managed vault keys, you assume responsibility for securing against unauthorized access and accidental deletion. If a key is deleted, any snapshots encrypted with it will be unretrievable.
Before you start
-
After creation, only the vault name and display color can be changed. All other settings are permanent. Make sure you know, and double-check, the settings you need before creating the vault.
-
Review About Self-Managed Vault Keys, paying special attention to Best practices.
-
Make sure you have a KMS key ready:
-
AWS: A customer-managed KMS key in the same region as the vault. If using a multi-region key, make sure the key has a replica in the vault region.
-
GCP: A Cloud KMS key in the same region as the vault.
-
Set the vault configuration
-
In the Vaults page, click Create Vault. The Create vault panel opens.
-
Set the vault’s display name, cloud provider, region, and display color. Pay special attention to the cloud provider and region:
-
Cloud provider must be either AWS or GCP.
-
The key (or replica in AWS) must be in the same region as the vault.
-
-
Expand Advanced options and turn on Use my own KMS key (AWS) or Use my own Cloud KMS key (GCP).
-
Click Set Key.
Set the key and grant access
In the key selection dialog, provide the key identifier and grant Eon access to use the key.
AWS vault
GCP vault
-
In the KMS key ARN field, paste the key’s ARN.
-
Click Edit Key Policy in AWS to open the key in the AWS console.
-
Copy the policy statement from the code panel and add it to the key policy in AWS. This grants Eon permission to use your key for encrypting backups.
The policy also contains a statement that grants your currently connected restore accounts permission to access the key when restoring from the vault.
-
Click Done to return to the Create vault panel.
You can always grant access to additional restore accounts later. That’s not required at this time, but will be required when you want to restore or query snapshots from vaults that use this key.
If the test is successful, the vault is created, and your self-managed key is used when encrypting snapshots to the vault. When configuring backup policies, you can now select the new vault as the destination for snapshots.
If the test fails, you’ll see an error message with the reason it failed. Make sure the key is in the vault’s region and that you’ve granted Eon access to the key. For troubleshooting help, contact Eon Support.