Customer keys for databases and volumes

Postgres and persistent container volumes can now be encrypted with a customer-managed key:

const key = new alien.Key("customer-key").build()

const db = new alien.Postgres("db").encryptionKey(key).build()

const search = new alien.Container("search")
  .code({ type: "image", image: "ghcr.io/acme/search:2.1" })
  .persistentStorage("200Gi", { mountPath: "/data", encryptionKey: key })
  .build()

On AWS, the key encrypts Aurora storage, snapshots, and Performance Insights data, and EBS volumes and their snapshots. Storage buckets already supported .encryptionKey() on AWS, Google Cloud, and Azure.

The key on a resource can't change after the resource exists. A stack that uses a key on a platform that doesn't support it fails the build, not the deployment.

Hosted AWS deployments in your own cloud can use the customer's key too, so a single-tenant deployment keeps data encrypted with a key the customer holds.

Read the docs →