Hi, I'm Ask INFA!
What would you like to know?
ASK INFAPreview
Please to access Ask INFA.
Not Found
English

Page Not Found

The page or file you are looking for has been moved or no longer exists.

The following links might help you find the content you need:


You can also search the Documentation Portal or visit the home page.

English
  • Administrator
  • All Products

Table of Contents

Search

  1. Preface
  2. Advanced clusters
  3. Setting up Amazon Web Services
  4. Setting up Google Cloud
  5. Setting up Microsoft Azure
  6. Setting up a self-service cluster
  7. Local cluster setup
  8. Advanced configurations
  9. Troubleshooting advanced clusters
  10. Appendix A: Command reference

Advanced Clusters

Advanced Clusters

Back Next

Encrypt staging data and log files at rest (optional)

Encrypt staging data and log files at rest (optional)

Optionally, set up Amazon S3 default encryption for S3 buckets to automatically encrypt staging data and log files that are stored on Amazon S3.
You can set up Amazon S3 default encryption for S3 buckets using one of the following encryption options:
Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
Use SSE-S3 to encrypt individual staging and log files or to encrypt the S3 buckets that contain the staging and log locations.
Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)
Use SSE-KMS to encrypt individual staging and log files. If you create user-defined master and worker roles, you can also encrypt the S3 buckets that contain the staging and log locations.
For more information about the encryption options, refer to the AWS documentation.
If you use SSE-KMS and create user-defined master and worker roles, you can restrict the customer master key (CMK) IDs that the master and worker roles can access to encrypt and decrypt data.
Specify the key IDs in the policies that are attached to the master and worker roles. In each policy, edit the Resource element in the following statement that determines actions on AWS Key Management Service (KMS): 
        {
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": [
                "*"
            ]
        }
If you use SSE-KMS, you must use the default AWS-managed CMK on your Amazon account. You cannot create a custom CMK.
0 COMMENTS
We’d like to hear from you!