You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/hcp-docs/content/docs/hcp/europe.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,7 +52,7 @@ HCP Europe provides the following benefits to managing your cloud deployments:
52
52
53
53
HCP Europe provides the same reliability and uninterrupted access to data as the global HCP platform. To provide 24-hour support, data from HCP Europe may be accessed from members of our support team in other regions.
54
54
55
-
To learn more about our data governance policies, visit the [HashiCorp EU Trust Center](https://www.hashicorp.com/en/trust/eu).
55
+
To learn more about our data governance policies, visit the [HashiCorp EU Trust Center](https://www.hashicorp.com/en/trust/privacy/hcp-data-privacy).
Copy file name to clipboardExpand all lines: content/terraform-docs-common/docs/cloud-docs/hold-your-own-key/concepts.mdx
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,27 +1,27 @@
1
1
---
2
-
page_title: Hold your own key concepts
2
+
page_title: Hold your own key concepts for HCP Terraform
3
3
description: >-
4
4
Learn how HCP Terraform's hold your own key feature encrypts and decrypts state and plan data, which data HCP Terraform encrypts, and the effects of hold your own key encryption on state and plan files.
5
5
tfc_only: true
6
6
---
7
7
8
8
# Hold your own key concepts
9
9
10
-
Hold your own key lets you authenticate a key management system with HCP Terraform to encrypt HCP Terraform state and plan data with a key that you provide and control.
10
+
The hold your own key (HYOK) feature lets you authenticate a key management system with HCP Terraform to encrypt HCP Terraform state and plan data with a key that you provide and control.
11
11
12
12
@include 'tfc-package-callouts/hyok.mdx'
13
13
14
14
Terraform artifacts can contain sensitive information, such as resource IDs, IP addresses, credentials, and other configuration details that Terraform uses to manage infrastructure. To secure sensitive data, HCP Terraform uses a HashiCorp-managed key to encrypt sensitive data such as state and plan files before storage.
15
15
16
-
Hold your own key (HYOK) gives you control over your sensitive data by letting you provide your own encryption key to safeguard that data. Hold your own key lets you configure HCP Terraform artifact encryption using a key from a key management system (KMS) that you control.
16
+
The hold your own key (HYOK) feature gives you control over your sensitive data by letting you provide your own encryption key to safeguard that data. HYOK lets you configure HCP Terraform artifact encryption using a key from a key management system (KMS) that you control.
17
17
18
-
When you enable hold your own key, the HCP Terraform agent encrypts specific Terraform artifacts using a data encryption key (DEK) before uploading those files to HCP Terraform storage. To ensure you retain control of the DEK, the HCP Terraform agent authenticates with your key management service (KMS) and uses a key encryption key (KEK) to encrypt the DEK.
18
+
When you enable hold your own key encryption, the HCP Terraform agent encrypts specific Terraform artifacts using a data encryption key (DEK) before uploading those files to HCP Terraform storage. To ensure you retain control of the DEK, the HCP Terraform agent authenticates with your key management service (KMS) and uses a key encryption key (KEK) to encrypt the DEK.
19
19
20
20
You can run the HCP Terraform agent on your own infrastructure, meaning that neither your KEK nor unencrypted secrets are uploaded to HCP Terraform, and no out-of-network traffic needs to connect to your KMS.
21
21
22
22
## What is encrypted
23
23
24
-
The artifacts that HCP Terraform agents encrypt with hold your own key are:
24
+
The artifacts that HCP Terraform agents encrypt with HYOK are:
25
25
26
26
-[State files](/terraform/language/state) and [JSON state files](/terraform/internals/json-format).
27
27
-[Plan files](/terraform/cli/commands/plan#out-filename) and [JSON plan files](/terraform/internals/json-format#plan-representation).
@@ -39,7 +39,7 @@ Learn more about [Sensitive data in state](/terraform/language/state/sensitive-d
39
39
40
40
## Sanitized state and plan files
41
41
42
-
Hold your own key also produces sanitized versions of artifacts that redact secrets from the artifacts it encrypts. Sanitized state and plan files let HCP Terraform continue running policy checks, run tasks, cost estimation, and assessments without using sensitive data.
42
+
The hold your own key (HYOK) feature also produces sanitized versions of artifacts that redact secrets from the artifacts it encrypts. Sanitized state and plan files let HCP Terraform continue running policy checks, run tasks, cost estimation, and assessments without using sensitive data.
43
43
44
44
The sanitized state and sanitized plan artifacts are JSON files with the same content and format as the `json-state` and `json-plan` outputs, with sensitive data redacted.
Copy file name to clipboardExpand all lines: content/terraform-docs-common/docs/cloud-docs/hold-your-own-key/configure.mdx
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
-
page_title: Configure and manage keys
2
+
page_title: Configure and manage keys for HCP Terraform
3
3
description: >-
4
-
Learn how to set up hold your own key encryption for HCP Terraform, letting you secure your sensitive data in state and plan files using a key from an external key management system.
4
+
Learn how to set up hold your own key (HYOK) encryption for HCP Terraform, letting you secure your sensitive data in state and plan files using a key from an external key management system.
Copy file name to clipboardExpand all lines: content/terraform-docs-common/docs/cloud-docs/hold-your-own-key/index.mdx
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,13 +1,13 @@
1
1
---
2
-
page_title: Encrypt your state and plan files
2
+
page_title: Encrypt your state and plan files for HCP Terraform
3
3
description: >-
4
-
Hold your own key lets you authenticate a key management system with HCP Terraform to encrypt HCP Terraform state and plan data with a key that you control.
4
+
The hold your own key (HYOK) feature lets you authenticate a key management system with HCP Terraform to encrypt HCP Terraform state and plan data with a key that you control.
5
5
tfc_only: true
6
6
---
7
7
8
8
# Encrypt your state and plan files
9
9
10
-
Hold your own key lets you authenticate a key management system with HCP Terraform to encrypt HCP Terraform state and plan data with a key that you provide and control.
10
+
The hold your own key (HYOK) feature lets you authenticate a key management system with HCP Terraform to encrypt HCP Terraform state and plan data with a key that you provide and control.
11
11
12
12
## Introduction
13
13
@@ -17,35 +17,35 @@ Terraform artifacts can contain sensitive information, such as resource IDs, IP
17
17
18
18
For most users, the default level of security that HCP Terraform provides is sufficient. However, the side effect of default encryption is that HCP Terraform maintains access to your Terraform artifacts. You cannot monitor or revoke HCP Terraform's access to your artifacts, which might be insufficient for your compliance requirements.
19
19
20
-
Hold your own key (HYOK) gives you control over your sensitive data by letting you provide your own encryption key to safeguard that data. Hold your own key lets you configure HCP Terraform artifact encryption using a key from a key management system (KMS) that you control. Use hold your own key to retain control of the keys HCP Terraform uses to encrypt data in state and plan files, enhance your security, and meet your compliance requirements.
20
+
The hold your own key (HYOK) feature gives you control over your sensitive data by letting you provide your own encryption key to safeguard that data. HYOK lets you configure HCP Terraform artifact encryption using a key from a key management system (KMS) that you control. Use HYOK to retain control of the keys HCP Terraform uses to encrypt data in state and plan files, enhance your security, and meet your compliance requirements.
21
21
22
-
When you enable hold your own key, the [HCP Terraform agent](/terraform/cloud-docs/agents) secures certain Terraform artifacts using your key before uploading those artifacts to HCP Terraform storage. To accomplish this, the HCP Terraform agent authenticates with your key management service, then encrypts the necessary artifacts. You can run the HCP Terraform agent on your own infrastructure, meaning that neither your key nor unencrypted secrets are ever uploaded to HCP Terraform, and no out-of-network traffic needs to connect to your key management service.
22
+
When you enable HYOK, the [HCP Terraform agent](/terraform/cloud-docs/agents) secures certain Terraform artifacts using your key before uploading those artifacts to HCP Terraform storage. To accomplish this, the HCP Terraform agent authenticates with your key management service, then encrypts the necessary artifacts. You can run the HCP Terraform agent on your own infrastructure, meaning that neither your key nor unencrypted secrets are ever uploaded to HCP Terraform, and no out-of-network traffic needs to connect to your key management service.
23
23
24
-
The artifacts that HCP Terraform agents encrypt with hold your own key are:
24
+
The artifacts that HCP Terraform agents encrypt with HYOK are:
25
25
26
26
-[State files](/terraform/language/state) and [JSON state files](/terraform/internals/json-format)
27
27
-[Plan files](/terraform/cli/commands/plan#out-filename) and [JSON plan files](/terraform/internals/json-format#plan-representation)
28
28
29
-
Hold your own key supports the following key management services:
29
+
The hold your own key feature supports the following key management services:
30
30
31
31
- AWS Key Management Service
32
32
- Azure Key Vault
33
33
- Google Cloud Key Management
34
34
- Vault transit secrets engine
35
35
36
-
To learn how to configure hold your own key for your organization, refer to [Configure and manage keys](/terraform/cloud-docs/hold-your-own-key/configure).
36
+
To learn how to configure HYOK for your organization, refer to [Configure and manage keys](/terraform/cloud-docs/hold-your-own-key/configure).
37
37
38
-
Hold your own key also produces sanitized versions of artifacts which redact secrets from the artifacts it encrypts. Sanitized state and plan files let HCP Terraform continue running policy checks, run tasks, cost estimation, and assessments without accessing sensitive data.
38
+
The hold your own key feature also produces sanitized versions of artifacts which redact secrets from the artifacts it encrypts. Sanitized state and plan files let HCP Terraform continue running policy checks, run tasks, cost estimation, and assessments without accessing sensitive data.
39
39
40
40
Refer to [How hold your own key concepts](/terraform/cloud-docs/hold-your-own-key/concepts) to learn more about the details of how HYOK encryption and decryption works.
41
41
42
42
## Workflow
43
43
44
-
To create a key configuration for hold your own key, you must perform the following steps:
44
+
To create a key configuration for HYOK, you must perform the following steps:
45
45
46
46
1. Configure your key management system to accept OIDC requests from HCP Terraform, and create a key that your KMS will use to encrypt and decrypt the keys HYOK uses to secure your data.
47
47
1. Configure your key in HCP Terraform.
48
-
1. Enable hold your own key on one or more workspaces.
Hold your own key is available on the HCP Terraform **Premium** edition. Refer to [HCP Terraform pricing](https://www.hashicorp.com/products/terraform/pricing) for details.
3
+
The hold your own key feature is available on the HCP Terraform **Premium** edition. Refer to [HCP Terraform pricing](https://www.hashicorp.com/products/terraform/pricing) for details.
0 commit comments