Enable Customer Managed Keys for your Organization on Amazon Web Services

Back Next

Frequently asked questions

When I clicked Test Managed Key in Informatica Intelligent Cloud Services , the test failed. What should I do?: If you get an error when testing the key, perform the following checks:

In
Informatica Intelligent Cloud Services

Administrator
, verify that the key settings on the
Settings
page match the settings for the CMK in the AWS Management Console.
In the AWS Management Console, verify that the status of the CMK is active.
In the AWS Management Console, verify that the permissions on the CMK allow Informatica cryptographic access to the key.

If you continue to encounter errors, contact Informatica Global Customer Support.
What happens if the CMK is rotated in AWS KMS?: You can rotate the key in AWS KMS manually or on a schedule. Rotating a key creates a new version of the key. The old version of the key remains in AWS KMS and is used for decryption only.

Informatica Intelligent Cloud Services
cannot detect key rotation in AWS KMS. Therefore, you'll need to disable customer managed keys in
Informatica Intelligent Cloud Services
and reenable it.

On the
Settings
page in
Informatica Intelligent Cloud Services

Administrator
, click the
Security
tab and note the
Key ARN
and
Role ARN
.
Disable the
Enable Customer Managed Keys
option.
Enable the
Enable Customer Managed Keys
option, reenter the key ARN and role ARN, and click the save (checkmark) icon.
What if I need to update the CMK in AWS KMS?: If you need to update the CMK, first provision a new CMK in AWS KMS. Then, update the key details on the
Settings
page in
Informatica Intelligent Cloud Services

Administrator
.
Be sure to keep the old version of the CMK in AWS KMS active until you update the key details in
Informatica Intelligent Cloud Services
.

You can delete the old version of the CMK in AWS KMS after you update the key details on the
Settings
page in
Informatica Intelligent Cloud Services

Administrator
.
What if I want Informatica to manage key encryption?: If you want Informatica to manage key encryption, you can disable the
Enable Customer Managed Keys
option on the
Settings
page in
Informatica Intelligent Cloud Services

Administrator
:

When you do this, be sure to keep the current version of the CMK in AWS KMS active. If the CMK is not active, disabling customer managed keys in
Informatica Intelligent Cloud Services
fails.

When you disable this option, your organization's encryption keys are once again encrypted using encryption keys that are managed by Informatica. It can take up to 10 minutes for the Informatica encryption keys to become active.

You can disable or delete the CMK in AWS KMS after you disable the
Enable Customer Managed Keys
option in
Administrator
.
What if I want to temporarily revoke Informatica's access to the CMK?: If you want to temporarily revoke Informatica's access to the CMK, you can disable the key in AWS KMS.

When you disable the CMK,
Informatica Intelligent Cloud Services
can no longer unencrypt your organization's encrypted data, and any jobs that use the data will fail until you reactivate the CMK in AWS KMS.
How do I replace the CMK if I suspect it has been compromised?: If you want to replace the CMK, you can delete the key in AWS KMS and create a new one.

Deleting the CMK in AWS KMS results in permanent loss to any encrypted data in
Informatica Intelligent Cloud Services
and causes the jobs that use the data to fail.

If you need to replace the CMK, perform the following steps so that you don't lose access to the encrypted data and jobs don't fail:

In
Administrator
, open the
Settings
page, click the
Security
tab, and disable the
Enable Customer Managed Keys
option.
In the AWS Management Console, delete the CMK.
In the AWS Management Console, create a new CMK.
On the
Settings
page in
Informatica Intelligent Cloud Services

Administrator
, re-enable the
Enable Customer Managed Keys
option and enter the details for the new CMK.
Can I delete the CMK if I don't want Informatica to access any of my encrypted data?: Deleting the CMK in AWS KMS results in permanent loss to any encrypted data in
Informatica Intelligent Cloud Services
and causes the jobs that use the data to fail.

If you're sure that you want Informatica to forgo all access to your encrypted data in
Informatica Intelligent Cloud Services
, you can delete the CMK in AWS KMS.

Rename Saved Search

Table of Contents

Enable Customer Managed Keys for your Organization on Amazon Web Services

Enable Customer Managed Keys for your Organization on Amazon Web Services

Frequently asked questions

Frequently asked questions