Native resource encryption

Use this path when Alien creates the resource that stores the data. You describe the key once in alien.ts; each customer connects the cloud KMS key for their deployment.

import * as alien from "@alienplatform/core"

const customerKey = new alien.Key("customer-key").build()
const data = new alien.Storage("customer-data")
  .encryptionKey(customerKey)
  .build()

export default new alien.Stack("app")
  .add(customerKey, "frozen", { remoteAccess: true })
  .add(data, "frozen")
  .build()

The important line is:

new alien.Storage("customer-data").encryptionKey(customerKey)

encryptionKey accepts an alien.Key, not a string or an arbitrary resource. Keep the key and storage in the same stack.

What happens for each customer

alien.ts
  │
  ├── Key("customer-key")
  └── Storage("customer-data") uses that key
          │
          ▼
customer deployment
  │
  ├── customer connects their cloud KMS key
  └── storage is encrypted with the connected key

The remoteAccess: true option lets your product connect the customer to this key through the customer setup flow. Use the same resource ID—customer-key in this example—when you create that handoff.

For data stored by your own application, use the Encrypt/Decrypt API. For AWS services that already accept a KMS key ARN, use an AWS Virtual Key.