Encrypt your tenant with Reltio Shield

Learn how to generate your Amazon KMS keys after downloading the Shield installation script files.

After you’ve downloaded and extracted the Shield installation script, use the script to:

Determine whether your tenant is encrypted
Create a new Amazon Key Management Services (KMS) key for your tenant
Set up key rotation option to rotate keys automatically every year

The script provides Reltio Shield for DynamoDB for Data at Rest encryption, generating a new Amazon Key Management Services (KMS) key for each region of your DynamoDB instance. You can select the key material origin you want to use:

AWS_KMS: An Amazon Web Services KMS key. For this material origin, you can set a key rotation option to rotate the key automatically once every year.
EXTERNAL: You provide your own key material file, which will be encrypted and imported to the key script generates. You need to have OpenSSL v.3.0 or later installed to use this option.

Note: The script runs in your own AWS environment and account. It does not require cross-account trust or external IDs. If you use AWS access keys, the credentials are used only for one-time key creation and key policy setup. After that, Reltio IAM roles access the KMS key through the key policy. Your credentials are not required for ongoing operations.

Tip: The Reltio Shield installation script is written in Python v3.9, so you need to have Python installed to run it.

Prerequisites for encryption

Before encrypting your tenant, ensure you have the following information. You may find it helpful to print this page and record your information in advance for easy reference.

Table 1. Information required to encrypt your tenant with Reltio Shield
Particulars	Required information	Your details
Tenant Configuration
Reltio Tenant	Tenant ID
Reltio Tenant	Tenant URL
Authorization Server credentials	Authentication method: `password` or `client_credentials`
	Client ID and client secret
	Username (required for `password` grant type only)
	Password (required for `password` grant type only)
Encryption key information
AWS Credentials	AWS authentication
	Recommended: IAM role or instance profile attached to the machine running the script, with these KMS permissions: `kms:CreateKey`, `kms:CreateAlias`, `kms:PutKeyPolicy`, `kms:DescribeKey`
	Alternative: AWS access key ID and secret access key for an IAM user with the same KMS permissions
Key material origin
AWS KMS	Automatic key rotation required?
External	Name of the file containing external encryption key details

Note: If an IAM role or instance profile is configured on your machine, the script detects it automatically, so you can omit the aws block. Otherwise, enter the AWS access key ID, secret access key, and optional session token in the aws section.

To encrypt your tenant using the Reltio Shield installation script

Open a command-line interface (CLI) and open the extracted Shield script folder.
Run this command to install the required Python dependencies : pip install -r requirements.txt

Create your configuration file.

In the root folder, copy config_pattern.json and fill it out with the values from the Information required for installing Reltio Shield table that is explained earlier in this topic. The configuration file uses this format:


{{
          "auth": {
              "server": "<URL to the auth server>",
              "grant_type": "password",
              "client": {
                  "id": "<Client ID for auth server>",
                  "secret": "<Client secret for auth server>"
              },
              "user": {
                  "username": "<Username for Reltio REST operations>",
                  "password": "<Password for Reltio REST operations>"
              },
              "environment_url": "<Your Reltio Environment URL>",
              "tenant_id": "<Your Reltio Tenant ID>"
          },
          "aws": {
              "access_key": "<Access key for your AWS account>",
              "secret_key": "<Secret key for your AWS account>",
              "session_token": "<Session token for AWS, optional>"
          },
          "keys": {
              "shield": {
                  "type_of_key": "KMS",
                  "auto_key_rotation": "true",
                  "path_to_key_origin": "<Path to the binary shield key material file, only when type_of_key is EXTERNAL>"
              },
              "backup": {
                  "type_of_key": "KMS",
                  "auto_key_rotation": "true",
                  "path_to_key_origin": "<Path to the binary backup key material file, only when type_of_key is EXTERNAL>"
              },
              "path_to_ssl": "<Path to the OpenSSL executable, optional if OpenSSL is already on your PATH>"
          }
      }

You can name this file anything (for example, config-prod.json), and you can keep separate configuration files for different tenants and environments.

Set grant_type to password or client_credentials. By default, it is set to password. For password, provide both the client and user sections. For client_credentials, provide the client section and omit the user section.
Set type_of_key to KMS or EXTERNAL for the shield key and the backup key independently. KMS: The script generates the key using AWS KMS as the key material origin. EXTERNAL: The script imports the key material file you provide (set in path_to_key_origin) instead of generating the key material itself.
Set auto_key_rotation to true or false . This option applies only when type_of_key is KMS.
If you set type_of_key to EXTERNAL for either key, place your key material file in the root folder before running the script.

Set the logging level. In the Shield script directory, open logger.py and edit the init_logger() function to one of these levels: logging.FATAL, logging.WARN, logging.INFO, logging.DEBUG, or logging.NOTSET. The default level is logging.DEBUG.
Run this command to start the Reltio Shield encryption script:
```
python enable_shield.py --c your-config-file.json
```
Optional: To see all available options, run:
```
python enable_shield.py -h
```

Result

Reltio Shield updates the key policy for the tenant and encrypts the data. In the Reltio Console, the page indicates that Reltio Shield is enabled and you manage the encryption key.

Unify and manage your data

Encrypt your tenant with Reltio Shield

Prerequisites for encryption

Result

Footer