Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add note about not supporting customer managed keys #1025

Merged
merged 4 commits into from
Sep 30, 2024
Merged

Add note about not supporting customer managed keys #1025

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ea99e3c
Add note about not supporting customer managed keys
mikaylathompson Sep 27, 2024
8310e07
kms->aws
mikaylathompson Sep 27, 2024
a7d4633
Incorporate suggested wording
mikaylathompson Sep 28, 2024
52446ed
fix issue link
mikaylathompson Sep 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,3 +23,9 @@ If you are concerned about this scenario, we recommend fully mitigating it by pu
The output tuples, available on the shared EFS volume via the Migration Console, contain the exact requests and responses received from both the source and target clusters with the headers and the body of the messages. The Authorization header is present on SigV4 signed requests and those using basic authorization, and with basic authorization credentials can be extracted from the header value. These values are often essential for debugging and so are not censored from the output.

If you use basic authorization credentials, ensure that access to your output tuples is protected similarly to the credentials themselves.

### Customer Managed Keys are not supported by the migration infrastructure
Each of the AWS services that are interacting with data will encrypt all data being stored at rest. While the services themselves can support performing the encryption via a KMS Key, the CDK deployment option of Migration Assistant doesn't have the ability to set a customer key for any of those services. That will leave all of the data at rest encrypted, but not under the control of a customer's KMS Key. See the links below for more details on forthcoming support:

https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html
[Issue #1026](https://github.com/opensearch-project/opensearch-migrations/issues/1026)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: shows up on the same line, having another newline may be clearer