Cloud keys
Data in the cloud is usually locked with keys the cloud provider holds. Roost lets you hold those keys yourself, in two ways.
Hold your own key
Roost acts as an external key store for cloud key management services. The cloud service never receives the key: each time it needs to open data, it asks Roost, and the request passes policy, quorum, limits and audit like any other. Cut the connection and the cloud cannot open your data.
roost cloud connect aws --region ap-northeast-2 --partition prod
roost cloud connect gcp --project acme-prod --partition prod
# the console shows the cloud's key references next to the Roost key that backs themBring your own key
Where a cloud service must hold a key copy, Roost generates it inside the box and sends it wrapped with the cloud's import key. The last step of the import wizard is a passkey approval, so who placed which key in which cloud is on record.
Cloud keys
| Cloud | Key | Status | Purpose | Protection | Next rotation | Roost key |
|---|---|---|---|---|---|---|
| AWS ap-northeast-2 | orders-db | Available | Encrypt · Decrypt | External key store | 12 Dec | data-key-eu v2 |
| Google asia-northeast3 | bq-cmek | Available | Encrypt · Decrypt | External key manager | 12 Dec | data-key-eu v2 |
| Azure koreacentral | vault-byok | Available | Wrap · Unwrap | Bring your own key | 1 Mar | kek-azure v1 |
One list
The console lists keys across clouds with their state, purpose, rotation schedule and the Roost key behind each, live, without a refresh schedule: every use leaves a record.