CPM supports custom encryption keys for DR

CPM supports custom encryption keys for DR

To support the usage of a custom encryption key for DR, you will need to perform the following:

In the account where the custom key resides:
    1. Go to KMS and browse to the key you wish to share.
    2. Go to  the "Other AWS accounts" at the bottom of the page and click "Add other AWS accounts".
    3. Add the AWS account ID of the DR account you wish to share the key with.
Go to the volume or RDS you wish to copy to DR account and/or region and add the following tag:
    1. The tag’s “key” = cpm_dr_encryption_key
    2. The tag’s “value” = The full arn of the encryption key you shared in item #1. For example- arn:aws:kms:us-east-1:123456789101:key/2eaadfb1-b630-4aef-9d90-2d0fb2061e05
    3. If you perform cross-region DR, you will need to have a key for each region as AWS does not allow sharing encryption keys across regions.
      The tag’s “key” should include the region where the key is, for example- Ohio key tag will be: key = cpm_dr_encryption_key:us-east-2 , value = arn:aws:kms:us-east-2:123456789101:key/2eaadfb1-b630-4aef-9d90-2d0fb2061e05
If a matching encryption key is not found with an alias or with custom tags, the behaviour of the backup depends on the setting in the Encryption Key Detection list in the Security tab of the General Settings screen:


The setting options for the encryption key detection are:
  1. Use Default Key – If the encryption key is not matched, the default encryption key is used.
  2. Strict – DR encryption key must match, either with an alias or a custom tag.
  3. Use Default Key & Alert – Use the default key and send an alert.
For more details on this topic see this section of the CPM User Guide.