Managing Encryption Keys and Zones
Interacting with the KMS and creating encryption zones requires the use of two CLI
commands: hadoop key and hdfs crypto. Before getting started
with creating encryption keys and setting up encryption zones, make sure that your KMS ACLs have
been set up according to best practices.
Validating Hadoop Key Operations hadoop key create to create a test key, and then use hadoop key list to retrieve the key list.Creating Encryption Zones hadoop key and hdfs crypto command-line tools to create encryption keys and set up new encryption zones.Adding Files to an Encryption Zone distcp. Deleting Encryption Zones Backing Up Encryption Keys very important that you regularly back up your encryption keys. Failure to do so can result in irretrievable loss of encrypted data.Rolling Encryption Keys ezKeyVersionName). Rolling EZ keys regularly helps enterprises minimize the risk of key exposure. If a malicious attacker were to obtain the EZ key and decrypt encrypted data encryption keys (EDEKs) into DEKs, they could gain the ability to decrypt HDFS files. Rolling an EZ key ensures that all DEKs for newly-created files will be encrypted with the new version of the EZ key. The older EZ key version that the attacker obtained cannot decrypt these EDEKs. Deleting Encryption Zone Keys Delete a Key Re-encrypting Encrypted Data Encryption Keys (EDEKs) 