You may have situations where you want to change or rotate an encryption key. Rotating the encryption key on a regular basis can help reduce risk for a number of data security scenarios.
Rotate a key
When you rotate a key, you can choose to generate or upload a new key. When you choose to upload, you can use a wrapped or plain text key.
Note: You must provide your existing key material in order to rotate away from an uploaded key. If the plain text key doesn't match the previous key, you will not be allowed to rotate, remove, or switch to a wrapped key.
To rotate to a key generated by Workiva:
- From Organization Admin, click Security and go to Key Management.
- Click Rotate Key and select Generate new key.
- Click Browse to locate the file that contains the existing key material.
- Click Rotate Key.
To rotate to a new wrapped key:
- From Organization Admin, click Security and go to Key Management.
- Click Rotate Key and select Upload new key.
- For Key Type, select Wrapped key.
- Complete Step 1: Click Download public key and use it to wrap your encryption key. Once you download the public key, you have 24 hours to wrap and upload the new key.
- Complete Step 2: Select Browse and upload your wrapped key. This key must be a 256-bit symmetric key wrapped by the public key downloaded in Step 1.
- Complete Step 3: Select Browse and upload your existing key material.
Note: This step is only required if you are rotating from a plain text key.
-
Click Rotate Key.
-
Check the box to confirm that you’ll keep a plain text copy of your key and click Rotate Key.
Your key will only be stored in AWS KMS, and Workiva can’t access your key material.
Your BYOK encrypted data is now encrypted with your wrapped key.
To rotate to a new plain text key:
- From Organization Admin, click Security and go to Key Management.
- Click Rotate Key and select Upload new key.
- For Key Type, select Plain text key.
- Click Browse and then select the file that includes your encryption key and click upload. The key must be a 256-bit symmetric encryption key.
- Click Browse and upload your existing key material.
-
Click Rotate Key.
-
Check the box to confirm that you’ll keep a plain text copy of your key and click Rotate Key.
Your key will only be stored in AWS KMS, and Workiva can’t access your key material.
Your BYOK encrypted data is now encrypted with your wrapped key.