Enabling CMEK Encryption

Enables Customer-Managed Encryption Keys (CMEK) on CockroachDB Cloud clusters so that data-at-rest encryption is controlled by keys in the organization's own cloud provider KMS (AWS KMS, GCP Cloud KMS, or Azure Key Vault). CMEK gives organizations full control over key lifecycle, rotation, and revocation.

When to Use This Skill

• Enabling CMEK for regulatory or compliance requirements (SOC 2, HIPAA, PCI DSS)
• Verifying CMEK is properly configured after initial setup
• Rotating CMEK keys per organization key rotation policy
• Responding to a security audit finding about encryption at rest
• Understanding CMEK requirements and plan prerequisites

Prerequisites