<!-- CANARY: REQ=REQ-SEC-AUDIT-LOG-001; FEATURE="Security"; ASPECT=AuditLog; STATUS=TESTED; OWNER=security; UPDATED=2026-01-16 -->
<h2 id="key-management-system-kms-integration" class="position-relative d-flex align-items-center group">
<span>Key Management System (KMS) Integration</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="key-management-system-kms-integration"
aria-haspopup="dialog"
aria-label="Share link: Key Management System (KMS) Integration">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h2><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden>
<div class="hsm-dialog" role="document">
<div class="hsm-header">
<h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2>
<button type="button" class="hsm-close" aria-label="Close">
<i class="fa-solid fa-xmark"></i>
</button>
</div>
<div class="hsm-body">
<label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label>
<div class="input-group mb-4 hsm-url-group">
<input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" />
<button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy">
<i class="fa-duotone fa-clipboard" aria-hidden="true"></i>
</button>
</div>
<div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div>
<div class="hsm-share-grid">
<a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer">
<i class="fa-brands fa-twitter me-2"></i>Twitter
</a>
<a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer">
<i class="fa-brands fa-linkedin me-2"></i>LinkedIn
</a>
<a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer">
<i class="fa-brands fa-facebook me-2"></i>Facebook
</a>
</div>
</div>
</div>
</div>
<style>
.heading-share-modal {
position: fixed;
inset: 0;
display: flex;
justify-content: center;
align-items: center;
background: rgba(0, 0, 0, 0.6);
z-index: 1050;
padding: 1rem;
backdrop-filter: blur(4px);
-webkit-backdrop-filter: blur(4px);
}
.heading-share-modal[hidden] { display: none !important; }
.hsm-dialog {
max-width: 420px;
width: 100%;
background: var(--bs-body-bg, #fff);
color: var(--bs-body-color, #212529);
border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1));
border-radius: 1rem;
box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25);
overflow: hidden;
animation: hsm-fade-in 0.2s ease-out;
}
@keyframes hsm-fade-in {
from { opacity: 0; transform: scale(0.95); }
to { opacity: 1; transform: scale(1); }
}
[data-bs-theme="dark"] .hsm-dialog {
background: #1e293b;
border-color: rgba(255,255,255,0.1);
color: #f8f9fa;
}
.hsm-header {
display: flex;
justify-content: space-between;
align-items: center;
padding: 1rem 1.5rem;
border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1));
background: rgba(0,0,0,0.02);
}
[data-bs-theme="dark"] .hsm-header {
background: rgba(255,255,255,0.02);
border-color: rgba(255,255,255,0.1);
}
.hsm-close {
background: transparent;
border: none;
color: inherit;
opacity: 0.5;
padding: 0.25rem 0.5rem;
border-radius: 0.25rem;
font-size: 1.2rem;
line-height: 1;
transition: opacity 0.2s;
}
.hsm-close:hover {
opacity: 1;
}
.hsm-body {
padding: 1.5rem;
}
.hsm-url-group {
display: flex !important;
align-items: stretch;
}
.hsm-url-group .form-control {
flex: 1;
min-width: 0;
margin: 0;
background: var(--bs-secondary-bg, #f8f9fa);
border-color: var(--bs-border-color, #dee2e6);
border-top-right-radius: 0;
border-bottom-right-radius: 0;
height: 42px;
}
.hsm-url-group .btn {
flex: 0 0 auto;
margin: 0;
margin-left: -1px;
border-top-left-radius: 0;
border-bottom-left-radius: 0;
height: 42px;
display: flex;
align-items: center;
justify-content: center;
padding: 0 1.25rem;
z-index: 2;
}
[data-bs-theme="dark"] .hsm-url-group .form-control {
background: #0f172a;
border-color: #334155;
color: #e2e8f0;
}
.hsm-share-grid {
display: flex;
flex-direction: column;
gap: 0.5rem;
}
.hsm-share-grid .btn {
display: flex;
align-items: center;
justify-content: center;
font-size: 0.9rem;
padding: 0.6rem;
border-color: var(--bs-border-color);
width: 100%;
}
[data-bs-theme="dark"] .hsm-share-grid .btn {
color: #e2e8f0;
border-color: #475569;
}
[data-bs-theme="dark"] .hsm-share-grid .btn:hover {
background: #334155;
border-color: #cbd5e1;
}
</style>
<script>
(function(){
const modal = document.getElementById('headingShareModal');
if(!modal) return;
const input = modal.querySelector('#headingShareInput');
const copyBtn = modal.querySelector('.hsm-copy');
const twitter = modal.querySelector('#share-twitter');
const linkedin = modal.querySelector('#share-linkedin');
const facebook = modal.querySelector('#share-facebook');
const closeBtn = modal.querySelector('.hsm-close');
let lastFocus=null;
let trapBound=false;
function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; }
function isOpen(){ return !modal.hasAttribute('hidden'); }
function hydrate(id){
const url=buildUrl(id);
input.value=url;
const enc=encodeURIComponent(url);
const text=encodeURIComponent(document.title);
if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`;
if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`;
if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`;
}
function openModal(id){
lastFocus=document.activeElement;
hydrate(id);
if(!isOpen()){
modal.removeAttribute('hidden');
}
requestAnimationFrame(()=>{ input.focus(); });
trapFocus();
}
function closeModal(){
if(!isOpen()) return;
modal.setAttribute('hidden','');
if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus();
}
function copyCurrent(){
try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); }
catch(e){ fallback(); }
}
function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} }
function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); }
function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); }
function bindShareButtons(){
document.querySelectorAll('.h-share').forEach(btn=>{
if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; }
});
}
bindShareButtons();
if(document.readyState==='loading'){
document.addEventListener('DOMContentLoaded', bindShareButtons);
} else {
requestAnimationFrame(bindShareButtons);
}
document.addEventListener('click', function(e){
const shareBtn=e.target.closest && e.target.closest('.h-share');
if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); }
}, true);
document.addEventListener('click', e=>{
if(e.target===modal) closeModal();
if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); }
if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); }
});
document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); });
function trapFocus(){
if(trapBound) return;
trapBound=true;
modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } });
}
if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); });
})();
</script><p>Geode provides enterprise-grade Key Management Service integration for Transparent Data Encryption (TDE) with support for multiple KMS providers, automated key rotation, and comprehensive audit trails.</p>
<h3 id="overview" class="position-relative d-flex align-items-center group">
<span>Overview</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="overview"
aria-haspopup="dialog"
aria-label="Share link: Overview">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="why-use-external-kms" class="position-relative d-flex align-items-center group">
<span>Why Use External KMS?</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="why-use-external-kms"
aria-haspopup="dialog"
aria-label="Share link: Why Use External KMS?">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><p>External Key Management Systems provide:</p>
<ul>
<li><strong>Centralized Key Storage</strong>: Master keys stored in hardware security modules (HSM)</li>
<li><strong>Access Control</strong>: Fine-grained permissions and multi-factor authentication</li>
<li><strong>Audit Trails</strong>: Complete key access logging for compliance</li>
<li><strong>Key Rotation</strong>: Automated rotation with policy enforcement</li>
<li><strong>Disaster Recovery</strong>: Key backup and replication across regions</li>
<li><strong>Compliance</strong>: SOX, PCI-DSS, HIPAA, GDPR requirements</li>
</ul>
<h4 id="architecture" class="position-relative d-flex align-items-center group">
<span>Architecture</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="architecture"
aria-haspopup="dialog"
aria-label="Share link: Architecture">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><p>Geode uses <strong>envelope encryption</strong> for optimal security and performance:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">Master Key (in KMS - HSM-backed)
</span></span><span class="line"><span class="cl"> └─ Data Encryption Key (DEK, wrapped by master)
</span></span><span class="line"><span class="cl"> ├─ Data Page Encryption
</span></span><span class="line"><span class="cl"> └─ WAL Record Encryption
</span></span></code></pre></div><p><strong>Benefits</strong>:</p>
<ul>
<li>Master keys never leave KMS</li>
<li>DEKs encrypted at rest (wrapped)</li>
<li>Fast local encryption with DEKs</li>
<li>Master key rotation without re-encrypting data</li>
</ul>
<h3 id="supported-kms-providers" class="position-relative d-flex align-items-center group">
<span>Supported KMS Providers</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="supported-kms-providers"
aria-haspopup="dialog"
aria-label="Share link: Supported KMS Providers">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3><table>
<thead>
<tr>
<th>Provider</th>
<th>Use Case</th>
<th>Features</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>HashiCorp Vault</strong></td>
<td>Enterprise, on-premise</td>
<td>Transit engine, dynamic secrets, audit</td>
</tr>
<tr>
<td><strong>AWS KMS</strong></td>
<td>Cloud native AWS</td>
<td>HSM-backed, multi-region, automatic rotation</td>
</tr>
<tr>
<td><strong>Azure Key Vault</strong></td>
<td>Cloud native Azure</td>
<td>HSM-backed, RBAC, managed keys</td>
</tr>
<tr>
<td><strong>GCP Cloud KMS</strong></td>
<td>Cloud native GCP</td>
<td>HSM-backed, IAM integration</td>
</tr>
<tr>
<td><strong>Environment Variable</strong></td>
<td>Development only</td>
<td>Simple config, NOT for production</td>
</tr>
<tr>
<td><strong>File-based</strong></td>
<td>Local testing</td>
<td>File storage, NOT for production</td>
</tr>
</tbody>
</table>
<h3 id="quick-start" class="position-relative d-flex align-items-center group">
<span>Quick Start</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="quick-start"
aria-haspopup="dialog"
aria-label="Share link: Quick Start">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="using-hashicorp-vault" class="position-relative d-flex align-items-center group">
<span>Using HashiCorp Vault</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="using-hashicorp-vault"
aria-haspopup="dialog"
aria-label="Share link: Using HashiCorp Vault">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 1. Set Vault environment</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">VAULT_ADDR</span><span class="o">=</span><span class="s2">"https://vault.company.com"</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">VAULT_TOKEN</span><span class="o">=</span><span class="s2">"hvs.CAESI..."</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 2. Configure Geode</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">GEODE_KMS_PROVIDER</span><span class="o">=</span><span class="s2">"vault"</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">GEODE_VAULT_KEY_PATH</span><span class="o">=</span><span class="s2">"geode/encryption"</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 3. Start Geode with Vault-backed TDE</span>
</span></span><span class="line"><span class="cl">./geode serve --enable-tde --kms-provider vault
</span></span></code></pre></div>
<h4 id="using-aws-kms" class="position-relative d-flex align-items-center group">
<span>Using AWS KMS</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="using-aws-kms"
aria-haspopup="dialog"
aria-label="Share link: Using AWS KMS">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 1. Set AWS credentials</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">AWS_REGION</span><span class="o">=</span><span class="s2">"us-east-1"</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">AWS_ACCESS_KEY_ID</span><span class="o">=</span><span class="s2">"AKIA..."</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">AWS_SECRET_ACCESS_KEY</span><span class="o">=</span><span class="s2">"..."</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 2. Configure Geode</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">GEODE_KMS_PROVIDER</span><span class="o">=</span><span class="s2">"aws"</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">GEODE_AWS_KMS_KEY_ID</span><span class="o">=</span><span class="s2">"arn:aws:kms:us-east-1:123456789012:key/..."</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 3. Start Geode</span>
</span></span><span class="line"><span class="cl">./geode serve --enable-tde --kms-provider aws
</span></span></code></pre></div>
<h3 id="hashicorp-vault-integration" class="position-relative d-flex align-items-center group">
<span>HashiCorp Vault Integration</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="hashicorp-vault-integration"
aria-haspopup="dialog"
aria-label="Share link: HashiCorp Vault Integration">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="prerequisites" class="position-relative d-flex align-items-center group">
<span>Prerequisites</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="prerequisites"
aria-haspopup="dialog"
aria-label="Share link: Prerequisites">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><ul>
<li>Vault 1.15.0+</li>
<li>Vault transit engine enabled</li>
<li>Valid authentication token</li>
<li>Network access to Vault server</li>
</ul>
<h4 id="setup-steps" class="position-relative d-flex align-items-center group">
<span>Setup Steps</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="setup-steps"
aria-haspopup="dialog"
aria-label="Share link: Setup Steps">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4>
<h5 id="1-enable-vault-transit-engine" class="position-relative d-flex align-items-center group">
<span>1. Enable Vault Transit Engine</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="1-enable-vault-transit-engine"
aria-haspopup="dialog"
aria-label="Share link: 1. Enable Vault Transit Engine">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Enable transit secrets engine</span>
</span></span><span class="line"><span class="cl">vault secrets <span class="nb">enable</span> -path<span class="o">=</span>geode transit
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Create encryption key</span>
</span></span><span class="line"><span class="cl">vault write -f geode/keys/master-key
</span></span></code></pre></div>
<h5 id="2-configure-vault-policy" class="position-relative d-flex align-items-center group">
<span>2. Configure Vault Policy</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="2-configure-vault-policy"
aria-haspopup="dialog"
aria-label="Share link: 2. Configure Vault Policy">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Create policy for Geode</span>
</span></span><span class="line"><span class="cl">vault policy write geode-tde - <span class="s"><<EOF
</span></span></span><span class="line"><span class="cl"><span class="s">path "geode/keys/master-key" {
</span></span></span><span class="line"><span class="cl"><span class="s"> capabilities = ["read"]
</span></span></span><span class="line"><span class="cl"><span class="s">}
</span></span></span><span class="line"><span class="cl"><span class="s">
</span></span></span><span class="line"><span class="cl"><span class="s">path "geode/encrypt/*" {
</span></span></span><span class="line"><span class="cl"><span class="s"> capabilities = ["create", "update"]
</span></span></span><span class="line"><span class="cl"><span class="s">}
</span></span></span><span class="line"><span class="cl"><span class="s">
</span></span></span><span class="line"><span class="cl"><span class="s">path "geode/decrypt/*" {
</span></span></span><span class="line"><span class="cl"><span class="s"> capabilities = ["create", "update"]
</span></span></span><span class="line"><span class="cl"><span class="s">}
</span></span></span><span class="line"><span class="cl"><span class="s">
</span></span></span><span class="line"><span class="cl"><span class="s">path "geode/keys/master-key/rotate" {
</span></span></span><span class="line"><span class="cl"><span class="s"> capabilities = ["update"]
</span></span></span><span class="line"><span class="cl"><span class="s">}
</span></span></span><span class="line"><span class="cl"><span class="s">EOF</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Create token with policy</span>
</span></span><span class="line"><span class="cl">vault token create -policy<span class="o">=</span>geode-tde -ttl<span class="o">=</span>8760h
</span></span></code></pre></div>
<h5 id="3-configure-geode" class="position-relative d-flex align-items-center group">
<span>3. Configure Geode</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="3-configure-geode"
aria-haspopup="dialog"
aria-label="Share link: 3. Configure Geode">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><p>Create <code>geode.yaml</code>:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">enabled</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">provider</span><span class="p">:</span><span class="w"> </span><span class="l">vault</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">vault</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">address</span><span class="p">:</span><span class="w"> </span><span class="s2">"https://vault.company.com:8200"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">token</span><span class="p">:</span><span class="w"> </span><span class="s2">"${VAULT_TOKEN}"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">key_path</span><span class="p">:</span><span class="w"> </span><span class="s2">"geode/keys/master-key"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="s2">"geode"</span><span class="w"> </span><span class="c"># Optional</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tls_verify</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">ca_cert</span><span class="p">:</span><span class="w"> </span><span class="s2">"/etc/geode/vault-ca.pem"</span><span class="w"> </span><span class="c"># Optional</span><span class="w">
</span></span></span></code></pre></div><p>Start Geode:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">VAULT_TOKEN</span><span class="o">=</span><span class="s2">"hvs.CAESI..."</span>
</span></span><span class="line"><span class="cl">./geode serve --config geode.yaml
</span></span></code></pre></div>
<h4 id="vault-operations" class="position-relative d-flex align-items-center group">
<span>Vault Operations</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="vault-operations"
aria-haspopup="dialog"
aria-label="Share link: Vault Operations">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4>
<h5 id="encrypt-data-key" class="position-relative d-flex align-items-center group">
<span>Encrypt Data Key</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="encrypt-data-key"
aria-haspopup="dialog"
aria-label="Share link: Encrypt Data Key">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Geode automatically wraps DEKs</span>
</span></span><span class="line"><span class="cl"><span class="c1"># Manual example:</span>
</span></span><span class="line"><span class="cl">vault write geode/encrypt/master-key <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> <span class="nv">plaintext</span><span class="o">=</span><span class="k">$(</span><span class="nb">echo</span> -n <span class="s2">"data-encryption-key-32-bytes"</span> <span class="p">|</span> base64<span class="k">)</span>
</span></span></code></pre></div>
<h5 id="decrypt-data-key" class="position-relative d-flex align-items-center group">
<span>Decrypt Data Key</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="decrypt-data-key"
aria-haspopup="dialog"
aria-label="Share link: Decrypt Data Key">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">vault write geode/decrypt/master-key <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> <span class="nv">ciphertext</span><span class="o">=</span><span class="s2">"vault:v1:abcd1234..."</span>
</span></span></code></pre></div>
<h5 id="rotate-master-key" class="position-relative d-flex align-items-center group">
<span>Rotate Master Key</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="rotate-master-key"
aria-haspopup="dialog"
aria-label="Share link: Rotate Master Key">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Rotate Vault key</span>
</span></span><span class="line"><span class="cl">vault write -f geode/keys/master-key/rotate
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Trigger Geode rewrap</span>
</span></span><span class="line"><span class="cl">geode key rewrap --kms-provider vault
</span></span></code></pre></div>
<h4 id="high-availability" class="position-relative d-flex align-items-center group">
<span>High Availability</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="high-availability"
aria-haspopup="dialog"
aria-label="Share link: High Availability">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">vault</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">address</span><span class="p">:</span><span class="w"> </span><span class="s2">"https://vault-cluster.company.com:8200"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">max_retries</span><span class="p">:</span><span class="w"> </span><span class="m">3</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">timeout</span><span class="p">:</span><span class="w"> </span><span class="l">30s</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">standby_addresses</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span>- <span class="s2">"https://vault-1.company.com:8200"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span>- <span class="s2">"https://vault-2.company.com:8200"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span>- <span class="s2">"https://vault-3.company.com:8200"</span><span class="w">
</span></span></span></code></pre></div>
<h3 id="aws-kms-integration" class="position-relative d-flex align-items-center group">
<span>AWS KMS Integration</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="aws-kms-integration"
aria-haspopup="dialog"
aria-label="Share link: AWS KMS Integration">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="prerequisites-1" class="position-relative d-flex align-items-center group">
<span>Prerequisites</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="prerequisites-1"
aria-haspopup="dialog"
aria-label="Share link: Prerequisites">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><ul>
<li>AWS account with KMS permissions</li>
<li>IAM role or access keys</li>
<li>KMS key created in desired region</li>
</ul>
<h4 id="setup-steps-1" class="position-relative d-flex align-items-center group">
<span>Setup Steps</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="setup-steps-1"
aria-haspopup="dialog"
aria-label="Share link: Setup Steps">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4>
<h5 id="1-create-kms-key" class="position-relative d-flex align-items-center group">
<span>1. Create KMS Key</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="1-create-kms-key"
aria-haspopup="dialog"
aria-label="Share link: 1. Create KMS Key">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Create customer-managed key</span>
</span></span><span class="line"><span class="cl">aws kms create-key <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --description <span class="s2">"Geode TDE Master Key"</span> <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --key-usage ENCRYPT_DECRYPT <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --origin AWS_KMS <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --multi-region
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Create alias</span>
</span></span><span class="line"><span class="cl">aws kms create-alias <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --alias-name alias/geode-tde <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --target-key-id <key-id>
</span></span></code></pre></div>
<h5 id="2-configure-iam-policy" class="position-relative d-flex align-items-center group">
<span>2. Configure IAM Policy</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="2-configure-iam-policy"
aria-haspopup="dialog"
aria-label="Share link: 2. Configure IAM Policy">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl"><span class="p">{</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"Version"</span><span class="p">:</span> <span class="s2">"2012-10-17"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"Statement"</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl"> <span class="p">{</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"Effect"</span><span class="p">:</span> <span class="s2">"Allow"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"Action"</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl"> <span class="s2">"kms:Encrypt"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="s2">"kms:Decrypt"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="s2">"kms:DescribeKey"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="s2">"kms:GenerateDataKey"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="s2">"kms:GenerateDataKeyWithoutPlaintext"</span>
</span></span><span class="line"><span class="cl"> <span class="p">],</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"Resource"</span><span class="p">:</span> <span class="s2">"arn:aws:kms:*:123456789012:key/*"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"Condition"</span><span class="p">:</span> <span class="p">{</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"StringEquals"</span><span class="p">:</span> <span class="p">{</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"kms:EncryptionContext:Application"</span><span class="p">:</span> <span class="s2">"Geode"</span>
</span></span><span class="line"><span class="cl"> <span class="p">}</span>
</span></span><span class="line"><span class="cl"> <span class="p">}</span>
</span></span><span class="line"><span class="cl"> <span class="p">}</span>
</span></span><span class="line"><span class="cl"> <span class="p">]</span>
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div>
<h5 id="3-configure-geode-1" class="position-relative d-flex align-items-center group">
<span>3. Configure Geode</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="3-configure-geode-1"
aria-haspopup="dialog"
aria-label="Share link: 3. Configure Geode">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">enabled</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">provider</span><span class="p">:</span><span class="w"> </span><span class="l">aws</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">aws</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">region</span><span class="p">:</span><span class="w"> </span><span class="s2">"us-east-1"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">key_id</span><span class="p">:</span><span class="w"> </span><span class="s2">"arn:aws:kms:us-east-1:123456789012:key/..."</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># Or use alias:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># key_id: "alias/geode-tde"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">encryption_context</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">Application</span><span class="p">:</span><span class="w"> </span><span class="s2">"Geode"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">Environment</span><span class="p">:</span><span class="w"> </span><span class="s2">"production"</span><span class="w">
</span></span></span></code></pre></div>
<h4 id="multi-region-deployment" class="position-relative d-flex align-items-center group">
<span>Multi-Region Deployment</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="multi-region-deployment"
aria-haspopup="dialog"
aria-label="Share link: Multi-Region Deployment">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">aws</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># Primary region</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">region</span><span class="p">:</span><span class="w"> </span><span class="s2">"us-east-1"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">key_id</span><span class="p">:</span><span class="w"> </span><span class="s2">"arn:aws:kms:us-east-1:123456789012:key/..."</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># Replicas for DR</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">replica_keys</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">eu-west-1</span><span class="p">:</span><span class="w"> </span><span class="s2">"arn:aws:kms:eu-west-1:123456789012:key/..."</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">ap-southeast-1</span><span class="p">:</span><span class="w"> </span><span class="s2">"arn:aws:kms:ap-southeast-1:123456789012:key/..."</span><span class="w">
</span></span></span></code></pre></div>
<h4 id="cost-optimization" class="position-relative d-flex align-items-center group">
<span>Cost Optimization</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="cost-optimization"
aria-haspopup="dialog"
aria-label="Share link: Cost Optimization">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">aws</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># Cache DEK for 1 hour</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">data_key_cache_seconds</span><span class="p">:</span><span class="w"> </span><span class="m">3600</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># Use 256-bit keys</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">data_key_spec</span><span class="p">:</span><span class="w"> </span><span class="s2">"AES_256"</span><span class="w">
</span></span></span></code></pre></div><p><strong>Estimated costs</strong> (AWS pricing):</p>
<ul>
<li>Key storage: $1/month per key</li>
<li>API requests: $0.03 per 10,000 requests</li>
<li>With 1-hour cache: ~$5/month for 1M operations/day</li>
</ul>
<h3 id="azure-key-vault-integration" class="position-relative d-flex align-items-center group">
<span>Azure Key Vault Integration</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="azure-key-vault-integration"
aria-haspopup="dialog"
aria-label="Share link: Azure Key Vault Integration">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="setup-steps-2" class="position-relative d-flex align-items-center group">
<span>Setup Steps</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="setup-steps-2"
aria-haspopup="dialog"
aria-label="Share link: Setup Steps">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4>
<h5 id="1-create-key-vault" class="position-relative d-flex align-items-center group">
<span>1. Create Key Vault</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="1-create-key-vault"
aria-haspopup="dialog"
aria-label="Share link: 1. Create Key Vault">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Create Key Vault</span>
</span></span><span class="line"><span class="cl">az keyvault create <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --name geode-kms <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --resource-group geode-rg <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --location eastus <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --enable-purge-protection <span class="nb">true</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Create encryption key</span>
</span></span><span class="line"><span class="cl">az keyvault key create <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --vault-name geode-kms <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --name geode-master-key <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --protection hsm <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --ops encrypt decrypt wrapKey unwrapKey
</span></span></code></pre></div>
<h5 id="2-configure-managed-identity" class="position-relative d-flex align-items-center group">
<span>2. Configure Managed Identity</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="2-configure-managed-identity"
aria-haspopup="dialog"
aria-label="Share link: 2. Configure Managed Identity">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Create managed identity for Geode</span>
</span></span><span class="line"><span class="cl">az identity create <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --name geode-identity <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --resource-group geode-rg
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Grant key permissions</span>
</span></span><span class="line"><span class="cl">az keyvault set-policy <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --name geode-kms <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --object-id <identity-object-id> <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --key-permissions encrypt decrypt wrapKey unwrapKey get
</span></span></code></pre></div>
<h5 id="3-configure-geode-2" class="position-relative d-flex align-items-center group">
<span>3. Configure Geode</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="3-configure-geode-2"
aria-haspopup="dialog"
aria-label="Share link: 3. Configure Geode">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">provider</span><span class="p">:</span><span class="w"> </span><span class="l">azure</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">azure</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">vault_url</span><span class="p">:</span><span class="w"> </span><span class="s2">"https://geode-kms.vault.azure.net/"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">key_name</span><span class="p">:</span><span class="w"> </span><span class="s2">"geode-master-key"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tenant_id</span><span class="p">:</span><span class="w"> </span><span class="s2">"..."</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">client_id</span><span class="p">:</span><span class="w"> </span><span class="s2">"..."</span><span class="w"> </span><span class="c"># Managed identity</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># Or use client secret:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># client_secret: "${AZURE_CLIENT_SECRET}"</span><span class="w">
</span></span></span></code></pre></div>
<h3 id="gcp-cloud-kms-integration" class="position-relative d-flex align-items-center group">
<span>GCP Cloud KMS Integration</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="gcp-cloud-kms-integration"
aria-haspopup="dialog"
aria-label="Share link: GCP Cloud KMS Integration">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="setup-steps-3" class="position-relative d-flex align-items-center group">
<span>Setup Steps</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="setup-steps-3"
aria-haspopup="dialog"
aria-label="Share link: Setup Steps">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4>
<h5 id="1-create-keyring-and-key" class="position-relative d-flex align-items-center group">
<span>1. Create Keyring and Key</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="1-create-keyring-and-key"
aria-haspopup="dialog"
aria-label="Share link: 1. Create Keyring and Key">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Create keyring</span>
</span></span><span class="line"><span class="cl">gcloud kms keyrings create geode-keyring <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --location us-east1
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Create key</span>
</span></span><span class="line"><span class="cl">gcloud kms keys create geode-master-key <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --location us-east1 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --keyring geode-keyring <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --purpose encryption <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --protection-level hsm
</span></span></code></pre></div>
<h5 id="2-configure-iam" class="position-relative d-flex align-items-center group">
<span>2. Configure IAM</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="2-configure-iam"
aria-haspopup="dialog"
aria-label="Share link: 2. Configure IAM">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Grant Geode service account permissions</span>
</span></span><span class="line"><span class="cl">gcloud kms keys add-iam-policy-binding geode-master-key <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --location us-east1 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --keyring geode-keyring <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --member serviceAccount:[email protected] <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --role roles/cloudkms.cryptoKeyEncrypterDecrypter
</span></span></code></pre></div>
<h5 id="3-configure-geode-3" class="position-relative d-flex align-items-center group">
<span>3. Configure Geode</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="3-configure-geode-3"
aria-haspopup="dialog"
aria-label="Share link: 3. Configure Geode">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">provider</span><span class="p">:</span><span class="w"> </span><span class="l">gcp</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">gcp</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">project_id</span><span class="p">:</span><span class="w"> </span><span class="s2">"my-project"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">location</span><span class="p">:</span><span class="w"> </span><span class="s2">"us-east1"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">keyring</span><span class="p">:</span><span class="w"> </span><span class="s2">"geode-keyring"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">key_name</span><span class="p">:</span><span class="w"> </span><span class="s2">"geode-master-key"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">credentials_file</span><span class="p">:</span><span class="w"> </span><span class="s2">"/etc/geode/gcp-credentials.json"</span><span class="w">
</span></span></span></code></pre></div>
<h3 id="key-rotation" class="position-relative d-flex align-items-center group">
<span>Key Rotation</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="key-rotation"
aria-haspopup="dialog"
aria-label="Share link: Key Rotation">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="automatic-rotation" class="position-relative d-flex align-items-center group">
<span>Automatic Rotation</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="automatic-rotation"
aria-haspopup="dialog"
aria-label="Share link: Automatic Rotation">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><p>Configure automatic rotation policies:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">rotation</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">enabled</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">schedule</span><span class="p">:</span><span class="w"> </span><span class="s2">"0 0 * * 0"</span><span class="w"> </span><span class="c"># Weekly on Sunday</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">min_age</span><span class="p">:</span><span class="w"> </span><span class="s2">"90d"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">max_age</span><span class="p">:</span><span class="w"> </span><span class="s2">"365d"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">rewrap_on_rotate</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span></code></pre></div>
<h4 id="manual-rotation" class="position-relative d-flex align-items-center group">
<span>Manual Rotation</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="manual-rotation"
aria-haspopup="dialog"
aria-label="Share link: Manual Rotation">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Rotate master key in KMS</span>
</span></span><span class="line"><span class="cl">geode key rotate --scope master
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Rewrap all DEKs with new master key</span>
</span></span><span class="line"><span class="cl">geode key rewrap --all
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Check rotation status</span>
</span></span><span class="line"><span class="cl">geode key status
</span></span></code></pre></div><p><strong>Output</strong>:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">Master Key Status:
</span></span><span class="line"><span class="cl"> Current Version: v3
</span></span><span class="line"><span class="cl"> Created: 2026-01-15 10:30:00 UTC
</span></span><span class="line"><span class="cl"> Rotated: 2026-01-20 14:22:00 UTC
</span></span><span class="line"><span class="cl"> Next Rotation: 2026-04-20 (in 89 days)
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">Data Encryption Keys:
</span></span><span class="line"><span class="cl"> Active DEKs: 2
</span></span><span class="line"><span class="cl"> Rewrap Progress: 100% (5,234 / 5,234 keys)
</span></span><span class="line"><span class="cl"> Last Rewrap: 2026-01-20 14:25:33 UTC
</span></span></code></pre></div>
<h4 id="rotation-best-practices" class="position-relative d-flex align-items-center group">
<span>Rotation Best Practices</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="rotation-best-practices"
aria-haspopup="dialog"
aria-label="Share link: Rotation Best Practices">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><ol>
<li><strong>Schedule regular rotations</strong>: 90 days for compliance, 365 days for balance</li>
<li><strong>Test in staging</strong>: Verify rotation process before production</li>
<li><strong>Monitor progress</strong>: Track rewrap completion</li>
<li><strong>Backup before rotation</strong>: Create backup before major key changes</li>
<li><strong>Audit rotation events</strong>: Log all rotation activities</li>
</ol>
<h3 id="performance--optimization" class="position-relative d-flex align-items-center group">
<span>Performance &amp; Optimization</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="performance--optimization"
aria-haspopup="dialog"
aria-label="Share link: Performance &amp; Optimization">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="benchmarks" class="position-relative d-flex align-items-center group">
<span>Benchmarks</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="benchmarks"
aria-haspopup="dialog"
aria-label="Share link: Benchmarks">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><table>
<thead>
<tr>
<th>Operation</th>
<th>Expected Behavior</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td>DEK wrap/unwrap</td>
<td>External KMS latency (milliseconds-scale)</td>
<td>Primarily at startup or rotation</td>
</tr>
<tr>
<td>DEK cache hit</td>
<td>Microsecond-scale</td>
<td>Hot path</td>
</tr>
<tr>
<td>Page encryption (local DEK)</td>
<td>Sub-millisecond</td>
<td>Low overhead</td>
</tr>
<tr>
<td>KMS API call</td>
<td>External latency</td>
<td>Cached and infrequent</td>
</tr>
</tbody>
</table>
<h4 id="caching-strategy" class="position-relative d-flex align-items-center group">
<span>Caching Strategy</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="caching-strategy"
aria-haspopup="dialog"
aria-label="Share link: Caching Strategy">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">cache</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">enabled</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">ttl</span><span class="p">:</span><span class="w"> </span><span class="m">3600</span><span class="w"> </span><span class="c"># 1 hour</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">max_size</span><span class="p">:</span><span class="w"> </span><span class="m">1000</span><span class="w"> </span><span class="c"># DEKs</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">eviction</span><span class="p">:</span><span class="w"> </span><span class="s2">"lru"</span><span class="w">
</span></span></span></code></pre></div><p><strong>Cache behavior</strong>:</p>
<ul>
<li>DEKs cached after unwrap</li>
<li>Automatic refresh before expiry</li>
<li>LRU eviction under memory pressure</li>
<li>Track cache hit rate with telemetry and tune TTL/size</li>
</ul>
<h4 id="connection-pooling" class="position-relative d-flex align-items-center group">
<span>Connection Pooling</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="connection-pooling"
aria-haspopup="dialog"
aria-label="Share link: Connection Pooling">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">vault</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">connection_pool</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">max_connections</span><span class="p">:</span><span class="w"> </span><span class="m">10</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">idle_timeout</span><span class="p">:</span><span class="w"> </span><span class="l">300s</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">connection_timeout</span><span class="p">:</span><span class="w"> </span><span class="l">30s</span><span class="w">
</span></span></span></code></pre></div>
<h3 id="security-best-practices" class="position-relative d-flex align-items-center group">
<span>Security Best Practices</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="security-best-practices"
aria-haspopup="dialog"
aria-label="Share link: Security Best Practices">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="key-lifecycle" class="position-relative d-flex align-items-center group">
<span>Key Lifecycle</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="key-lifecycle"
aria-haspopup="dialog"
aria-label="Share link: Key Lifecycle">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><ol>
<li><strong>Generation</strong>: Use KMS native key generation (HSM-backed)</li>
<li><strong>Storage</strong>: Never store plaintext master keys</li>
<li><strong>Access</strong>: Restrict KMS permissions to Geode service account only</li>
<li><strong>Rotation</strong>: Regular rotation (90-365 days)</li>
<li><strong>Destruction</strong>: Secure key destruction per compliance requirements</li>
</ol>
<h4 id="network-security" class="position-relative d-flex align-items-center group">
<span>Network Security</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="network-security"
aria-haspopup="dialog"
aria-label="Share link: Network Security">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">vault</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tls_verify</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">ca_cert</span><span class="p">:</span><span class="w"> </span><span class="s2">"/etc/geode/ca.pem"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">client_cert</span><span class="p">:</span><span class="w"> </span><span class="s2">"/etc/geode/client.pem"</span><span class="w"> </span><span class="c"># mTLS</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">client_key</span><span class="p">:</span><span class="w"> </span><span class="s2">"/etc/geode/client-key.pem"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">min_tls_version</span><span class="p">:</span><span class="w"> </span><span class="s2">"1.3"</span><span class="w">
</span></span></span></code></pre></div>
<h4 id="authentication" class="position-relative d-flex align-items-center group">
<span>Authentication</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="authentication"
aria-haspopup="dialog"
aria-label="Share link: Authentication">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><p><strong>Vault</strong>:</p>
<ul>
<li>Use short-lived tokens (8-24 hours)</li>
<li>Rotate tokens regularly</li>
<li>Use Vault agents for token renewal</li>
<li>Avoid hardcoding tokens</li>
</ul>
<p><strong>AWS</strong>:</p>
<ul>
<li>Use IAM roles (not access keys)</li>
<li>Enable MFA for key operations</li>
<li>Use condition keys in policies</li>
<li>Audit key usage with CloudTrail</li>
</ul>
<p><strong>Azure</strong>:</p>
<ul>
<li>Use managed identities</li>
<li>Enable Key Vault firewall</li>
<li>Require VNet integration</li>
<li>Monitor with Azure Monitor</li>
</ul>
<h4 id="audit--compliance" class="position-relative d-flex align-items-center group">
<span>Audit &amp; Compliance</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="audit--compliance"
aria-haspopup="dialog"
aria-label="Share link: Audit &amp; Compliance">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">audit</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">enabled</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">log_key_operations</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">log_rotation_events</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">log_rewrap_operations</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">output</span><span class="p">:</span><span class="w"> </span><span class="s2">"/var/log/geode/kms-audit.log"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">format</span><span class="p">:</span><span class="w"> </span><span class="s2">"json"</span><span class="w">
</span></span></span></code></pre></div><p><strong>Audit log example</strong>:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl"><span class="p">{</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"timestamp"</span><span class="p">:</span> <span class="s2">"2026-01-24T10:30:00Z"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"operation"</span><span class="p">:</span> <span class="s2">"unwrap_dek"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"kms_provider"</span><span class="p">:</span> <span class="s2">"vault"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"key_id"</span><span class="p">:</span> <span class="s2">"master-key-v3"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"dek_id"</span><span class="p">:</span> <span class="s2">"dek-12345"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"user"</span><span class="p">:</span> <span class="s2">"geode-service"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"result"</span><span class="p">:</span> <span class="s2">"success"</span><span class="p">,</span>
</span></span><span class="line"><span class="cl"> <span class="nt">"latency_ms"</span><span class="p">:</span> <span class="mi">45</span>
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div>
<h3 id="disaster-recovery" class="position-relative d-flex align-items-center group">
<span>Disaster Recovery</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="disaster-recovery"
aria-haspopup="dialog"
aria-label="Share link: Disaster Recovery">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="backup-strategy" class="position-relative d-flex align-items-center group">
<span>Backup Strategy</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="backup-strategy"
aria-haspopup="dialog"
aria-label="Share link: Backup Strategy">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Backup KMS configuration</span>
</span></span><span class="line"><span class="cl">geode backup kms-config --output /backup/kms-config.json
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Backup encrypted DEKs (wrapped)</span>
</span></span><span class="line"><span class="cl">geode backup deks --output /backup/deks-encrypted.json
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Backup rotation state</span>
</span></span><span class="line"><span class="cl">geode backup rotation-state --output /backup/rotation.json
</span></span></code></pre></div>
<h4 id="recovery-process" class="position-relative d-flex align-items-center group">
<span>Recovery Process</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="recovery-process"
aria-haspopup="dialog"
aria-label="Share link: Recovery Process">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 1. Restore KMS configuration</span>
</span></span><span class="line"><span class="cl">geode restore kms-config --input /backup/kms-config.json
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 2. Verify KMS connectivity</span>
</span></span><span class="line"><span class="cl">geode verify kms --provider vault
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 3. Restore DEKs</span>
</span></span><span class="line"><span class="cl">geode restore deks --input /backup/deks-encrypted.json
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 4. Restore rotation state</span>
</span></span><span class="line"><span class="cl">geode restore rotation-state --input /backup/rotation.json
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 5. Verify data access</span>
</span></span><span class="line"><span class="cl">geode query <span class="s2">"RETURN 1"</span> --verify-encryption
</span></span></code></pre></div>
<h4 id="multi-region-failover" class="position-relative d-flex align-items-center group">
<span>Multi-Region Failover</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="multi-region-failover"
aria-haspopup="dialog"
aria-label="Share link: Multi-Region Failover">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">kms</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">failover</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">enabled</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">primary</span><span class="p">:</span><span class="w"> </span><span class="s2">"vault-us-east.company.com"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">replicas</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span>- <span class="s2">"vault-us-west.company.com"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span>- <span class="s2">"vault-eu-west.company.com"</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">health_check_interval</span><span class="p">:</span><span class="w"> </span><span class="l">30s</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">failover_timeout</span><span class="p">:</span><span class="w"> </span><span class="l">10s</span><span class="w">
</span></span></span></code></pre></div>
<h3 id="troubleshooting" class="position-relative d-flex align-items-center group">
<span>Troubleshooting</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="troubleshooting"
aria-haspopup="dialog"
aria-label="Share link: Troubleshooting">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="issue-kms-connection-failures" class="position-relative d-flex align-items-center group">
<span>Issue: KMS Connection Failures</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="issue-kms-connection-failures"
aria-haspopup="dialog"
aria-label="Share link: Issue: KMS Connection Failures">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><p><strong>Error</strong>:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">Error: Failed to connect to KMS provider: connection timeout
</span></span></code></pre></div><p><strong>Diagnosis</strong>:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Test network connectivity</span>
</span></span><span class="line"><span class="cl">curl -v https://vault.company.com:8200/v1/sys/health
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Verify credentials</span>
</span></span><span class="line"><span class="cl">vault token lookup
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Check Geode logs</span>
</span></span><span class="line"><span class="cl">tail -f /var/log/geode/kms.log
</span></span></code></pre></div><p><strong>Solutions</strong>:</p>
<ol>
<li>Verify network access (firewall, VPN)</li>
<li>Check KMS service health</li>
<li>Validate credentials/tokens</li>
<li>Review timeout settings</li>
</ol>
<h4 id="issue-dek-unwrap-failures" class="position-relative d-flex align-items-center group">
<span>Issue: DEK Unwrap Failures</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="issue-dek-unwrap-failures"
aria-haspopup="dialog"
aria-label="Share link: Issue: DEK Unwrap Failures">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><p><strong>Error</strong>:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">Error: Failed to unwrap data encryption key: invalid ciphertext
</span></span></code></pre></div><p><strong>Causes</strong>:</p>
<ul>
<li>Corrupted wrapped DEK</li>
<li>Wrong master key version</li>
<li>KMS key deleted</li>
</ul>
<p><strong>Solutions</strong>:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Check key status</span>
</span></span><span class="line"><span class="cl">geode key status --verbose
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Verify KMS key exists</span>
</span></span><span class="line"><span class="cl">vault <span class="nb">read</span> geode/keys/master-key
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Attempt rewrap</span>
</span></span><span class="line"><span class="cl">geode key rewrap --force --dek-id <id>
</span></span></code></pre></div>
<h4 id="issue-high-kms-latency" class="position-relative d-flex align-items-center group">
<span>Issue: High KMS Latency</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="issue-high-kms-latency"
aria-haspopup="dialog"
aria-label="Share link: Issue: High KMS Latency">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><p><strong>Symptom</strong>: Slow database startup or high operation latency</p>
<p><strong>Diagnosis</strong>:</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Profile KMS operations</span>
</span></span><span class="line"><span class="cl">geode profile kms --duration 60s
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Check cache hit rate</span>
</span></span><span class="line"><span class="cl">geode stats kms-cache
</span></span></code></pre></div><p><strong>Solutions</strong>:</p>
<ol>
<li>Increase DEK cache TTL</li>
<li>Use connection pooling</li>
<li>Deploy regional KMS replicas</li>
<li>Enable local cache warmup</li>
</ol>
<h3 id="compliance--standards" class="position-relative d-flex align-items-center group">
<span>Compliance &amp; Standards</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="compliance--standards"
aria-haspopup="dialog"
aria-label="Share link: Compliance &amp; Standards">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3>
<h4 id="regulatory-requirements" class="position-relative d-flex align-items-center group">
<span>Regulatory Requirements</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="regulatory-requirements"
aria-haspopup="dialog"
aria-label="Share link: Regulatory Requirements">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><table>
<thead>
<tr>
<th>Regulation</th>
<th>Requirement</th>
<th>Geode Support</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>PCI-DSS</strong></td>
<td>Key rotation every 365 days</td>
<td>✅ Automated rotation</td>
</tr>
<tr>
<td><strong>HIPAA</strong></td>
<td>Encryption key management</td>
<td>✅ KMS integration</td>
</tr>
<tr>
<td><strong>SOX</strong></td>
<td>Access control & audit</td>
<td>✅ Complete audit trail</td>
</tr>
<tr>
<td><strong>GDPR</strong></td>
<td>Data protection at rest</td>
<td>✅ TDE with KMS</td>
</tr>
<tr>
<td><strong>FIPS 140-2</strong></td>
<td>HSM-backed keys</td>
<td>✅ Vault/AWS KMS HSM</td>
</tr>
</tbody>
</table>
<h4 id="audit-requirements" class="position-relative d-flex align-items-center group">
<span>Audit Requirements</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="audit-requirements"
aria-haspopup="dialog"
aria-label="Share link: Audit Requirements">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tde</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">audit</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># PCI-DSS requirements</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">log_all_key_access</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">log_failed_operations</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">log_rotation_events</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># SOX requirements</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">tamper_proof_logs</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">log_retention_days</span><span class="p">:</span><span class="w"> </span><span class="m">2555</span><span class="w"> </span><span class="c"># 7 years</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># HIPAA requirements</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">encryption_algorithm_logging</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">key_lifecycle_logging</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></span></span></code></pre></div>
<h3 id="next-steps" class="position-relative d-flex align-items-center group">
<span>Next Steps</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="next-steps"
aria-haspopup="dialog"
aria-label="Share link: Next Steps">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3><ul>
<li><a
href="/docs/security/field-level-encryption/"
>Field-Level Encryption</a>
- Selective field encryption</li>
<li><a
href="/docs/security/overview/"
>Security Overview</a>
- Complete security architecture</li>
<li><a
href="/docs/security/field-level-encryption/"
>Field-Level Encryption</a>
- TDE and field-level encryption details</li>
<li><a
href="/docs/guides/backup-automation/"
>Backup Automation</a>
- Backup integration with KMS</li>
<li><a
href="/docs/configuration/server-configuration/"
>Server Configuration</a>
- KMS configuration options</li>
</ul>
<h3 id="references" class="position-relative d-flex align-items-center group">
<span>References</span>
<button type="button"
class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1"
data-share-target="references"
aria-haspopup="dialog"
aria-label="Share link: References">
<i class="fa-sharp-duotone fa-solid fa-share-nodes" aria-hidden="true" style="font-size: 0.8em;"></i>
<span class="visually-hidden">Share link</span>
</button>
</h3><ul>
<li><a
href="https://developer.hashicorp.com/vault/docs/secrets/transit"
aria-label="HashiCorp Vault Transit – opens in new window"
target="_blank" rel="noopener noreferrer"
>HashiCorp Vault Transit
<span aria-hidden="true" class="external-icon">↗</span>
</a>
- Vault encryption engine</li>
<li><a
href="https://docs.aws.amazon.com/kms/"
aria-label="AWS KMS Documentation – opens in new window"
target="_blank" rel="noopener noreferrer"
>AWS KMS Documentation
<span aria-hidden="true" class="external-icon">↗</span>
</a>
- AWS key management</li>
<li><a
href="https://learn.microsoft.com/en-us/azure/key-vault/"
aria-label="Azure Key Vault – opens in new window"
target="_blank" rel="noopener noreferrer"
>Azure Key Vault
<span aria-hidden="true" class="external-icon">↗</span>
</a>
- Azure KMS</li>
<li><a
href="https://cloud.google.com/kms/docs"
aria-label="GCP Cloud KMS – opens in new window"
target="_blank" rel="noopener noreferrer"
>GCP Cloud KMS
<span aria-hidden="true" class="external-icon">↗</span>
</a>
- Google Cloud KMS</li>
<li><a
href="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"
aria-label="NIST SP 800-57 – opens in new window"
target="_blank" rel="noopener noreferrer"
>NIST SP 800-57
<span aria-hidden="true" class="external-icon">↗</span>
</a>
- Key management</li>
</ul>
<hr>
<p><strong>License</strong>: Apache License 2.0
<strong>Copyright</strong>: 2024-2025 CodePros
<strong>Last Updated</strong>: January 2026</p>
Key Management System (KMS) Integration
Enterprise key management for Geode: HashiCorp Vault, AWS KMS, envelope encryption, automated rotation, and secure key lifecycle management