Cloudera Docs

Creating a new encryption key on AWS

If you don't have an existing encryption key, use the following instructions to create one.

  1. Go to the KMS console in the AWS Management Console.
  2. Select Customer managed keys.
  3. From the Region drop-down list, select the region in which you want to create and use the encryption key.
  4. Click Create key.
  5. In Step 1: Configure Key:
    1. Under Key type, choose Symmetric.
    2. Expand Advanced Options and under Key Material Origin, select KMS or External.
  6. In Step 2: Create Alias and Description:
    1. Enter an alias for your key.
    2. Defining tags is optional.
  7. In Step 3: Define Key Administrative Permissions, select the following:

    Choose your own IAM user/role used for logging into the AWS Management Console. Do not set AWSServiceRoleForAutoScaling or the cross-account IAM role as the key admin.

  8. In Step 4: Define Key Usage Permissions:
    1. Select the AWSServiceRoleForAutoScaling built-in role.
    2. Select the cross-account IAM role.
  9. In Step 5: Review and edit key policy, you may optionally tweak the key policy as desired, or simply leave it as generated by AWS.
  10. Go to the last page of the wizard and then click Finish to create an encryption key.