Encryption and CMEK

STACK encrypts operator credentials and identity data with envelope encryption. Production uses AWS KMS. Customer-managed encryption keys are available on Enterprise accounts.

Enable CMEK

An owner or admin submits a full AWS KMS key ARN or alias ARN. STACK performs a real GenerateDataKey and Decrypt test before it stores the configuration. The grant must allow both actions for the STACK principal.

curl -X POST https://api.getstack.run/v1/operator/cmek \
  -H "Authorization: Bearer $STACK_TOKEN" -H "Content-Type: application/json" \
  -d '{"key_arn":"arn:aws:kms:eu-north-1:123456789012:key/00000000-0000-0000-0000-000000000000"}'

The status moves from migrating to active after the worker re-encrypts long-lived stores. New writes use the customer key during migration.

Status and failure behavior

GET /v1/operator/cmek

The response includes the state, key ARN, activation time, and per-store migration rows. If KMS denies a live decrypt, STACK records revoked, clears cached key selection, and fails later protected operations without falling back to the platform key.

Rotate or replace a key

AWS KMS automatic rotation preserves the key ARN, so STACK needs no configuration change. To replace the ARN, remove CMEK, wait for status none, and enable the new key. STACK rejects a second key while a key is active or migrating.

Remove CMEK

curl -X DELETE https://api.getstack.run/v1/operator/cmek -H "Authorization: Bearer $STACK_TOKEN"

Removal changes the status to revoking. The worker re-encrypts long-lived data under the platform key. Short-lived Drop-off, invocation, and OAuth retry ciphertext expires under its original key. Removal finishes at status none.