Using encryption profiles

• You need to have the CDP_CB_CONFIGURE_ENCRYPTION_PROFILE entitlement enabled to use the encryption profiles in your environment. For more information about how to obtain the list of entitlements, contact Cloudera Customer Support.
• Creating encryption profiles can only be done using CDP CLI.
• Encryption profiles are only supported in environments using Cloudera Runtime 7.3.2.10000 (SP1).
• Encryption profiles are only supported in new Cloudera on cloud environments. You cannot modify an existing environment to use the encryption profiles.
• Custom encryption profiles cannot be deleted when it is attached to any of the resources, for example environment, Data Lake or Cloudera Data Hub.
• Currently the user cannot set a default Encryption Profile to be used for the creation of any new resource.

When creating a Cloudera on cloud environment, you need to provide the --encryption-profile parameter in the create environment command and define which encryption profile should be used as a value:

cdp environments create-aws-environment \
--environment-name rod-732-custom \
--credential-name ralves-cred \
--network-cidr 10.0.0.0/16 \
--region "eu-central-1" \
--security-access cidr=0.0.0.0/0 \
--tags key="owner",value="owner"  \
--endpoint-access-gateway-scheme PRIVATE \
--no-enable-tunnel \
--image os=redhat9 \
--authentication publicKeyId="ralves" \
--log-storage storageLocationBase=s3a://cdp/test/log,instanceProfile=arn:aws:iam::152813717728:instance-profile/rod-LOG_ROLE,backupStorageLocationBase=s3a://cdp/test/backup \
--create-private-subnets \
--no-create-service-endpoints \
--free-ipa instanceCountByGroup=1 \
--encryption-profile cdp_default_tls13_fips_140_3

Encryption profiles are inherited to FreeIPA, Data Lake and Cloudera Data Hub clusters if the encryption profile is set on the environment level. You can change the encryption profile to use a different one compared to the environment when creating the Data Lake and Cloudera Data Hub clusters. However, it is recommended to maintain an overlap in the cipher list to avoid breaking interoperability between clusters within a given environment.

cdp datalake create-aws-datalake \
--environment-name rod-732-custom \
...
--encryption-profile cdp_default_tls13_fips_140_3

cdp create-aws-cluster \
--environment-name rod-732-custom \
...
--encryption-profile cdp_default_tls13_fips_140_3

Using CDP CLI, you can create the encryption profiles with the create-encryption-profile and by defining the name, TLS version and cipher suites.

cdp environments create-encryption-profile --name my-ep --tls-versions TLSv1.2  TLSv1.3 --cipher-suites TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

The following cipher suites are supported in Cloudera on cloud:

// TLS 1.2 
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256,
TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384,
TLS_ECCPWD_WITH_AES_128_GCM_SHA256,
TLS_ECCPWD_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
TLS_ECCPWD_WITH_AES_256_CCM_SHA384,
TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,
TLS_ECDHE_ECDSA_WITH_AES_256_CCM,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
TLS_ECDHE_ECDSA_WITH_AES_128_CCM,
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
TLS_ECCPWD_WITH_AES_128_CCM_SHA256,
TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256,
TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256,
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_AES_256_CBC_SHA

// TLS 1.3
TLS_AES_256_GCM_SHA384,
TLS_CHACHA20_POLY1305_SHA256,
TLS_AES_128_GCM_SHA256,
TLS_AES_128_CCM_8_SHA256,
TLS_AES_128_CCM_SHA256

The following list details the recommended cipher suites, which needs to be considered when creating custom encryption profiles:

// TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
// TLS 1.3 
TLS_AES_128_GCM_SHA256,
TLS_AES_256_GCM_SHA384