Ensure Encryption at Rest Keys Are Managed by an External KMS and Retrieved at Startup

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Run ps -ef | grep -- "--enterprise-encryption": every encrypted store must have --enterprise-encryption=path=...,key=...,old-key=...,rotation-period=... Check the systemd unit and wrapper scripts (grep -Ri vault /etc/cockroach /etc/systemd/system) to confirm the store key is fetched from an external KMS (e.g. Vault) at startup rather than kept on the data volume.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Deploy or connect to a supported key management system: Such as HashiCorp Vault, AWS KMS, or another trusted external provider. 2. Configure the Systemd Service to enable encryption: Edit the service file at /etc/systemd/system/cockroach.service.