Symmetric data encryption

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the guides on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To encrypt data:

1. In the configuration file, describe the parameters of the yandex_kms_secret_ciphertext resource and specify the KMS key in the key_id field:

   resource "yandex_kms_secret_ciphertext" "password" {
     key_id      = "<key_ID>"
     aad_context = "additional authenticated data"
     plaintext   = "strong password"
   }
   

   Where:

   • key_id: KMS key ID.
   • aad_context: AAD context.
   • plaintext: String to encrypt.

   Warning

   With yandex_kms_secret_ciphertext, you can hide secrets when deploying an infrastructure, but generally speaking it is unsafe to specify plaintext and aad_context in the configuration file in plain text. Secrets can be read from configuration files or execution logs and can end up in the Terraform state.

   For more information about resource properties in Terraform, see this provider guide.

2. Validate your configuration using this command:

   terraform validate
   

   If the configuration is valid, you will get this message:

   Success! The configuration is valid.
   

3. Run this command:

   terraform plan
   

   You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

4. Apply the configuration changes:

   terraform apply
   

5. Type yes and press Enter to confirm the changes.

   After this, you can access the ciphertext through the ciphertext variable, and the encrypted data, through plaintext.

   For verification, you can add the following code with the decrypted_pass output variable to the configuration file.

   Alert

   This is not safe and can only be used for testing.

   output "decrypted_pass" {
     sensitive = true
     value     = yandex_kms_secret_ciphertext.password.plaintext
   }
   

   After updating the configuration, you can check the encrypted data using the command:

   terraform output decrypted_pass
   

   Result:

   "strong password"
   

To encrypt data, use the encrypt REST API method for the SymmetricCrypto resource or the SymmetricCryptoService/Encrypt gRPC API call.

For information about how to encrypt and decrypt data using the Yandex Cloud SDK, see Encrypting data using the Yandex Cloud SDK.

For information about how to encrypt and decrypt data using the AWS Encryption SDK, see Encrypting data using the AWS Encryption SDK.

For information about how to encrypt and decrypt data using Google Tink, see Encrypting data using Google Tink.

To decrypt data, use the decrypt REST API method for the SymmetricCrypto resource or the SymmetricCryptoService/Decrypt gRPC API call.

For information about how to encrypt and decrypt data using the Yandex Cloud SDK, see Encrypting data using the Yandex Cloud SDK.

For information about how to encrypt and decrypt data using the AWS Encryption SDK, see Encrypting data using the AWS Encryption SDK.

For information about how to encrypt and decrypt data using Google Tink, see Encrypting data using Google Tink.

To change the data encryption key or its version, use the reEncrypt REST API method for the SymmetricCrypto resource or the SymmetricCryptoService/ReEncrypt gRPC API call.