Rotate Encryption Keys

You can rotate the master encryption keys associated with an Autonomous Database on Dedicated Exadata Infrastructure using the Oracle Cloud Infrastructure Console.

Related Topics

Rotate the Encryption Key of an Autonomous Container Database

Required IAM Policies

manage autonomous-container-databases

Procedure

  1. Go to the Details page of the Autonomous Container Database whose encryption key you want to rotate.

    For instructions, see View Details of an Autonomous Container Database.

  2. Click Rotate Encryption Key.
  3. (Optional) To use a customer encryption key (BYOK), select Rotate using the customer-provided key (BYOK). BYOK is supported in Oracle Public Cloud only.
    • For External KMS: Each third-party key is automatically assigned a key version in the external HSM.
      • Rotate the third-party keys in the external HSM so that the external HSM generates a new key version.
      • Copy the version ID of the rotated key and use it to rotate the key reference in OCI Key Management (EKMS) so that OCI Key Management (EKMS) can create a new Key version OCID.
      • Copy the newly created Key Version OCID from EKMS.
    • For OCI Vaults: Enter the OCID of the imported customer encryption key in Key Version OCID. The Key Version OCID that you enter should be associated with the current encryption key of the Autonomous Container Database.
  4. Click Rotate encryption Key.
The Autonomous Container Database goes to the Updating status, the encryption key is rotated, and the Autonomous Container Database goes back to the Active status. How the encryption key is rotated depends on whether it is Oracle-managed or customer-managed :
  • Oracle-managed key: Autonomous Database rotates the encryption key, storing the new value in the secure key store on the Exadata system where the Autonomous Container Database resides.
  • Customer-managed key: Autonomous Database uses the underlying technology (Oracle Cloud Infrastructure Vault for Autonomous Container Databases on Oracle Public Cloud or Oracle Key Vault (OKV) for Autonomous Container Databases on either Oracle Public Cloud or Exadata Cloud@Customer) to rotate the key and store the new value as a new version of the key in underlying technology, and then associates this new version with the Autonomous Container Database.

    You can view the latest Key Version OCID and the entire Key History from your Autonomous Container Database details page.

    Note:

    In case of cross region Data Guard with Customer Managed Keys, the replicated vault used by the standby is read-only. So, when the standby assumes the primary role from a failover, you cannot rotate the key.

Rotate the Encryption Key of an Autonomous Database

You rotate the encryption key of an Autonomous Database from its Details page.

  1. Go to the Details page of the Autonomous Database whose encryption key you want to rotate.

    For instructions, see View Details of a Dedicated Autonomous Database.

  2. Click More Actions and then click Rotate Encryption Key.

  3. (Optional) To use a customer encryption key (BYOK), select Rotate using the customer-provided key (BYOK). BYOK is supported in Oracle Public Cloud only.
    • For External KMS: Each third-party key is automatically assigned a key version in the external HSM.
      • Rotate the third-party keys in the external HSM so that the external HSM generates a new key version.
      • Copy the version ID of the rotated key and use it to rotate the key reference in OCI Key Management (EKMS) so that OCI Key Management (EKMS) can create a new Key version OCID.
      • Copy the newly created Key Version OCID from EKMS.
    • For OCI Vaults: Enter the OCID of the imported customer encryption key in Key Version OCID. The Key Version OCID that you enter should be associated with the current encryption key of the Autonomous Container Database.
  4. Click Rotate encryption Key.
The Autonomous Database goes to the Updating status, the encryption key is rotated, and the Autonomous Database goes back to the Active status. How the encryption key is rotated depends on whether it is Oracle-managed or customer-managed:
  • Oracle-managed key: Autonomous Database rotates the encryption key, storing the new value in the secure key store on the Exadata system where the Autonomous Database resides.
  • Customer-managed key: Autonomous Database uses the underlying technology (Oracle Cloud Infrastructure Vault for Autonomous Container Databases on Oracle Public Cloud or Oracle Key Vault (OKV) for Autonomous Container Databases on either Oracle Public Cloud or Exadata Cloud@Customer) to rotate the key and store the new value as a new version of the key in underlying technology, and then associates this new version with the Autonomous Database.

    You can view the latest Key Version OCID and the entire Key History from your Autonomous Database details page.

    Note:

    In case of cross region Data Guard with Customer Managed Keys, the replicated vault used by the standby is read-only. So, when the standby assumes the primary role from a failover, you cannot rotate the key.