KMS integration #
KMS plays an important role for providing cryptographic keys security. Currently, Acra uses KMS to load Acra Master Key used for intermediate keys encrypting / decrypting. Since safety of Acra’s cryptographic keys directly depends on safety of Acra Master Key, Acra has strong requirements to KMSs and their security guarantees.
Refer to Acra in depth / Key storage and KMS to learn more about general key storage requirements.
Refer to Security controls / Key management to learn how to generate Acra Master Key.
Loading Acra Master Key #
On startup every Acra service or tool that needs access to intermediate keys should load Acra Master Key.
They load and store it in a memory and use it to decrypt intermediate key every time. After finishing operations with intermediate keys, a service forgets and erases them from memory to leave them in unprotected form as less as possible.
Only Acra Master Key loaded securely gives Acra access to intermediate keys and sensitive data protected with these keys.
The load could happen:
directly via environment variable (refer to Security Controls / Key management);
directly from KMS (AcraServer/AcraTranslator support KMS integration directly to read Acra Master Key, see below);
from KMS via environment variable (read keys from KMS using
curlor your preferred deployment tool, put it to the environment variable, startup Acra service from env variable).
Supported KMSs #
Hashicorp Vault #
Hashicorp Vault is popular, widely used service for secure storing sensitive data, especially secrets. Acra uses Hashicorp Vault as storage for master key used to encrypt/decrypt all private keys.
Hashicorp Vault supports a lot of storage backends, that guarantee high availability, scalability, authenticated and secure transport communication. That is why Acra supports it out of the box.
The following Acra services and tools can load Acra Master Key from this KMS.
You can find out how to configure access to KMS on
HashiCorp Vault section on the distinct documentation page of these services.
AWS KMS #
Support of AWS KMS is available only in Acra Enterprise Edition
GCP KMS #
Support of GCP KMS is available only in Acra Enterprise Edition
Support of Keywhiz is available only in Acra Enterprise Edition
Note that Acra Enterprise Edition provides better KMSs integration and more ways to load Acra Master Key.