Data encryption

Written by

Before you begin
Encrypt data
Decrypt data

In this section, you will learn how to use KMS to encrypt and decrypt small-sized data (of up to 32 KB) using the CLI and API. For more information about available encryption methods, see Which encryption method should I choose?

Before you begin

If you don't have the Yandex Cloud command line interface yet, install and initialize it.

Encrypt data

CLI

API

Terraform

SDK Yandex Cloud

AWS Encryption SDK

Google Tink

The command encrypts the plaintext passed in the --plaintext-file and writes the resulting ciphertext to the --ciphertext-file.

--id: ID of the KMS key, make sure you set either the --id or --name flag.
--name: Name of the KMS key, make sure you set either the --id or --name flag.
--version-id (optional): Version of the KMS key to be used for encryption. The primary version is used by default.
--plaintext-file: Input file with plaintext.
--aad-context-file (optional): Input file with AAD context.
--ciphertext-file: Output file with ciphertext.

yc kms symmetric-crypto encrypt \
  --id abj76v82ficsmn446ri7 \
  --plaintext-file plaintext-file \
  --ciphertext-file ciphertext-file

Use the encrypt method for the SymmetricCrypto resource.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it by configuration files. They store the infrastructure description in HashiCorp Configuration Language (HCL). Terraform and its providers are distributed under the Mozilla Public License.

For more information about the provider resources, see the documentation on the Terraform site or mirror site.

If you change the configuration files, Terraform automatically determines which part of your configuration is already deployed and what should be added or removed.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To encrypt data:

In the configuration file, describe the parameters of the yandex_kms_secret_ciphertext resource and specify the KMS key in the key_id field:
```
resource "yandex_kms_secret_ciphertext" "password" {
  key_id      = "<key ID>"
  aad_context = "additional authenticated data"
  plaintext   = "strong password"
}
```
Where:
- key_id: KMS key ID.
- aad_context: (AAD context).
- plaintext: String to be encrypted.
Warning

yandex_kms_secret_ciphertext enables you to hide secrets when deploying an infrastructure. However, in general, it's not safe to openly specify the plaintext and aad_context in the configuration file. Secrets can be read from configuration files or execution logs and can end up in the Terraform state.

For more information about resource parameters in Terraform, see the provider documentation.
Check the configuration using the command:
```
terraform validate
```
If the configuration is correct, the following message is returned:
```
Success! The configuration is valid.
```
Run the command:
```
terraform plan
```
The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contain errors, Terraform will point them out.
Apply the configuration changes:
```
terraform apply
```
Confirm the changes: type yes into the terminal and press Enter.

The ciphertext can then be accessed via the ciphertext variable, and the encrypted data via the plaintext variable.

To check, you can add the following code with the decrypted_pass output variable to a configuration file.

Alert

This is not safe and can only be used for testing.
```
output "decrypted_pass" {
  sensitive = true
  value     = yandex_kms_secret_ciphertext.password.plaintext
}
```
After updating the configuration, you can check the encrypted data using the command:
```
terraform output decrypted_pass
```
Result:
```
"strong password"
```

For information about how to encrypt and decrypt data using the Yandex Cloud SDK, see Encrypting data using the Yandex Cloud SDK.

For information about how to encrypt and decrypt data using the AWS Encryption SDK, see Encrypting data using the AWS Encryption SDK.

For information about how to encrypt and decrypt data using Google Tink, see Encrypting data using Google Tink.

Decrypt data

CLI

API