diff --git a/content/operate/rs/databases/import-export/export-data.md b/content/operate/rs/databases/import-export/export-data.md index 61c950d0bc..70be83ea96 100644 --- a/content/operate/rs/databases/import-export/export-data.md +++ b/content/operate/rs/databases/import-export/export-data.md @@ -180,6 +180,28 @@ To connect to an S3-compatible storage location: Replace `` with the location of the S3 CA certificate `ca.pem`. +#### Encrypt an export with a customer-provided key (SSE-C) + +To encrypt data exported to S3 or an S3-compatible location with a customer-provided key ([SSE-C](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html)), add an `encryption` object to `export_location` in an [export database request]({{}}): + +```json +{ + "export_location": { + "type": "s3", + "bucket_name": "backups", + "access_key_id": "XXXXXXXXXXXXX", + "secret_access_key": "XXXXXXXXXXXXXXXX", + "encryption": { + "type": "sse-c", + "sse_customer_key": "" + } + } +} +``` + +- `sse_customer_key` must be a base64-encoded string that decodes to exactly 32 bytes (AES-256). +- SSE-C encryption is only available for S3 and S3-compatible storage locations, and only for this one export request. You can't add `encryption` to a database's persisted [backup_location]({{}}) configuration, so SSE-C isn't available for [scheduled backups]({{}}). + ### Google Cloud Storage To export to a [Google Cloud](https://developers.google.com/console/) storage bucket: diff --git a/content/operate/rs/databases/import-export/import-data.md b/content/operate/rs/databases/import-export/import-data.md index de9658d265..6a68053299 100644 --- a/content/operate/rs/databases/import-export/import-data.md +++ b/content/operate/rs/databases/import-export/import-data.md @@ -270,6 +270,32 @@ POST /v1/bdbs//actions/import } ``` +#### Import from a source encrypted with a customer-provided key (SSE-C) + +To import from an S3 or S3-compatible source encrypted with a customer-provided key ([SSE-C](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html)), add an `encryption` object to the source in `dataset_import_sources`: + +```json +{ + "dataset_import_sources": [ + { + "type": "s3", + "bucket_name": "backups", + "subdir": "test-db", + "filename": ".rdb", + "access_key_id": "XXXXXXXXXXXXX", + "secret_access_key": "XXXXXXXXXXXXXXXX", + "encryption": { + "type": "sse-c", + "sse_customer_key": "" + } + } + ] +} +``` + +- `sse_customer_key` must be a base64-encoded string that decodes to exactly 32 bytes (AES-256). +- SSE-C encryption is only available for S3 and S3-compatible storage locations, and only for this one import request. You can't add `encryption` to a database's persisted [dataset_import_sources]({{}}) configuration. + ### Google Cloud Storage Before you import data from a [Google Cloud](https://developers.google.com/console/) storage bucket, make sure you have: diff --git a/content/operate/rs/databases/import-export/schedule-backups.md b/content/operate/rs/databases/import-export/schedule-backups.md index faa969a866..9f077dc6b0 100644 --- a/content/operate/rs/databases/import-export/schedule-backups.md +++ b/content/operate/rs/databases/import-export/schedule-backups.md @@ -229,6 +229,10 @@ To connect to an S3-compatible storage location: Replace `` with the location of the S3 CA certificate `ca.pem`. +{{< note >}} +Customer-provided encryption keys (SSE-C) aren't supported for scheduled backups. SSE-C is only available for on-demand [export]({{< relref "/operate/rs/databases/import-export/export-data.md" >}}) and [import]({{< relref "/operate/rs/databases/import-export/import-data.md" >}}) requests. +{{< /note >}} + ### Google Cloud Storage For [Google Cloud](https://developers.google.com/console/) subscriptions, store your backups in a Google Cloud Storage bucket: diff --git a/content/operate/rs/references/rest-api/objects/bdb/backup_location.md b/content/operate/rs/references/rest-api/objects/bdb/backup_location.md index 26cde75034..2eb5d093a4 100644 --- a/content/operate/rs/references/rest-api/objects/bdb/backup_location.md +++ b/content/operate/rs/references/rest-api/objects/bdb/backup_location.md @@ -57,6 +57,7 @@ Any additional required parameters may differ based on the backup/export locatio |----------|------|-------------| | access_key_id | string | The AWS Access Key ID with access to the bucket | | bucket_name | string | S3 bucket name | +| encryption | object | Customer-provided encryption key (SSE-C) configuration. Valid only in `export_location` for [export requests]({{}}) — the request fails if you include it in a database's persisted `backup_location`. See [Customer-provided encryption keys (SSE-C)](#sse-c) below. (optional) | | region_name | string | Amazon S3 region name (optional) | | secret_access_key | string | The AWS Secret Access Key that matches the Access Key ID | | subdir | string | Path to the backup directory in the S3 bucket (optional) | @@ -81,6 +82,15 @@ To connect to an S3-compatible storage location: Replace `` with the location of the S3 CA certificate `ca.pem`. +#### Customer-provided encryption keys (SSE-C) {#sse-c} + +| Key name | Type | Description | +|----------|------|-------------| +| type | string | Must be `"sse-c"`. | +| sse_customer_key | string | Base64-encoded encryption key that decodes to exactly 32 bytes (AES-256). | + +SSE-C is request-scoped: it's accepted only when passed directly to an [export]({{}}) or [import]({{}}) action, never as part of a database's persisted `backup_location` configuration. + ### Google Cloud Storage | Key name | Type | Description | diff --git a/content/operate/rs/references/rest-api/objects/bdb/dataset_import_sources.md b/content/operate/rs/references/rest-api/objects/bdb/dataset_import_sources.md index 38db76394e..5be233f00c 100644 --- a/content/operate/rs/references/rest-api/objects/bdb/dataset_import_sources.md +++ b/content/operate/rs/references/rest-api/objects/bdb/dataset_import_sources.md @@ -61,6 +61,7 @@ Any additional required parameters may differ based on the import location type. |----------|------|-------------| | access_key_id | string | The AWS Access Key ID with access to the bucket | | bucket_name | string | S3 bucket name | +| encryption | object | Customer-provided encryption key (SSE-C) configuration for a source encrypted with a customer key. Valid only when passed directly to the [import action]({{}}) — the request fails if you include it in a database's persisted `dataset_import_sources`. See [Customer-provided encryption keys (SSE-C)](#sse-c) below. (optional) | | filename | string | RDB filename, including the file extension. | | region_name | string | Amazon S3 region name (optional) | | secret_access_key | string | The AWS Secret Access that matches the Access Key ID | @@ -86,6 +87,15 @@ To connect to an S3-compatible storage location: Replace `` with the location of the S3 CA certificate `ca.pem`. +#### Customer-provided encryption keys (SSE-C) {#sse-c} + +| Key name | Type | Description | +|----------|------|-------------| +| type | string | Must be `"sse-c"`. | +| sse_customer_key | string | Base64-encoded encryption key that decodes to exactly 32 bytes (AES-256). | + +SSE-C is request-scoped: it's accepted only when passed directly to an [import]({{}}) action, never as part of a database's persisted `dataset_import_sources` configuration. + ### Google Cloud Storage | Key name | Type | Description | diff --git a/content/operate/rs/references/rest-api/requests/bdbs/actions/export.md b/content/operate/rs/references/rest-api/requests/bdbs/actions/export.md index c407aeb558..fbc137368e 100644 --- a/content/operate/rs/references/rest-api/requests/bdbs/actions/export.md +++ b/content/operate/rs/references/rest-api/requests/bdbs/actions/export.md @@ -75,6 +75,25 @@ The request body should contain a JSON object with the following export paramete The above request initiates an export operation to the specified location. +##### Example JSON body with a customer-provided encryption key (SSE-C) + +```json +{ + "export_location": { + "type": "s3", + "bucket_name": "backups", + "access_key_id": "XXXXXXXXXXXXX", + "secret_access_key": "XXXXXXXXXXXXXXXX", + "encryption": { + "type": "sse-c", + "sse_customer_key": "" + } + } +} +``` + +`encryption` is available only for S3 and S3-compatible `export_location` values. See [backup_location/export_location]({{< relref "/operate/rs/references/rest-api/objects/bdb/backup_location" >}}) for the field details. + ### Response {#post-response} Returns a status code. diff --git a/content/operate/rs/references/rest-api/requests/bdbs/actions/import.md b/content/operate/rs/references/rest-api/requests/bdbs/actions/import.md index 4d061ee6a4..e99c7c9a35 100644 --- a/content/operate/rs/references/rest-api/requests/bdbs/actions/import.md +++ b/content/operate/rs/references/rest-api/requests/bdbs/actions/import.md @@ -165,6 +165,29 @@ Azure Blob Storage example: } ``` +Customer-provided encryption key (SSE-C) example: + +```json +{ + "dataset_import_sources": [ + { + "type": "s3", + "bucket_name": "backups", + "subdir": "test-db", + "filename": ".rdb", + "access_key_id": "XXXXXXXXXXXXX", + "secret_access_key": "XXXXXXXXXXXXXXXX", + "encryption": { + "type": "sse-c", + "sse_customer_key": "" + } + } + ] +} +``` + +`encryption` is available only for S3 and S3-compatible sources. See [dataset_import_sources]({{< relref "/operate/rs/references/rest-api/objects/bdb/dataset_import_sources" >}}) for the field details. + ### Response {#post-response} Returns a status code.