cURL
curl --request POST \
--url https://cockroachlabs.cloud/api/v1/clusters/{cluster_id}/cmek \
--header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \
--data '{"region_specs":[{"key_spec":{"auth_principal":"arn:aws:iam::account:role/role-name-with-path","type":"AWS_KMS","uri":"arn:aws:kms:us-west-2:111122223333:key/id-of-kms-key"},"region":"us-central1"}]}'{
"region_infos": [
{
"key_infos": [
{
"created_at": "2023-11-07T05:31:56Z",
"spec": {
"auth_principal": "<string>",
"type": "AWS_KMS",
"uri": "<string>"
},
"status": "DISABLED",
"updated_at": "2023-11-07T05:31:56Z",
"user_message": "<string>"
}
],
"region": "<string>",
"status": "DISABLED"
}
],
"status": "DISABLED"
}{
"code": 123,
"details": [
{
"@type": "<string>"
}
],
"message": "<string>"
}Enable CMEK for a cluster
POST
/
api
/
v1
/
clusters
/
{cluster_id}
/
cmek
cURL
curl --request POST \
--url https://cockroachlabs.cloud/api/v1/clusters/{cluster_id}/cmek \
--header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \
--data '{"region_specs":[{"key_spec":{"auth_principal":"arn:aws:iam::account:role/role-name-with-path","type":"AWS_KMS","uri":"arn:aws:kms:us-west-2:111122223333:key/id-of-kms-key"},"region":"us-central1"}]}'{
"region_infos": [
{
"key_infos": [
{
"created_at": "2023-11-07T05:31:56Z",
"spec": {
"auth_principal": "<string>",
"type": "AWS_KMS",
"uri": "<string>"
},
"status": "DISABLED",
"updated_at": "2023-11-07T05:31:56Z",
"user_message": "<string>"
}
],
"region": "<string>",
"status": "DISABLED"
}
],
"status": "DISABLED"
}{
"code": 123,
"details": [
{
"@type": "<string>"
}
],
"message": "<string>"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Body
application/json
Show child attributes
Show child attributes
Response
A successful response.
CMEKClusterInfo contains the status of CMEK across an entire cluster, including within each one its regions.
Show child attributes
Show child attributes
CMEKStatus describes the current status of CMEK for an entire CRDB cluster or a CMEK key within a region.
- UNKNOWN_STATUS: UNKNOWN should never be used; if it is used, it indicates a bug.
- DISABLED: DISABLED corresponds to the state of a cluster or region-level key when CMEK has finished being disabled. By default, CMEK will be disabled for new clusters.
- DISABLING: DISABLING corresponds to the state of a cluster or region-level key when CMEK is in the process of being disabled.
- DISABLE_FAILED: DISABLE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be disabled.
- ENABLED: ENABLED corresponds to the state of a cluster or region-level key when CMEK is enabled.
- ENABLING: ENABLING corresponds to the state of a cluster or region-level key when CMEK is in the process of being enabled.
- ENABLE_FAILED: ENABLE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be enabled.
- ROTATING: ROTATING corresponds to the state of a cluster or region when the a new spec is in the process of being enabled while an existing spec is being disabled.
- ROTATE_FAILED: ROTATE_FAILED corresponds to the state of a cluster or region if there was a failure to update from one CMEK spec to another.
- REVOKED: REVOKED corresponds to the state of a cluster or region-level key when the customer has revoked CockroachLab's permissions for their key.
- REVOKING: REVOKING corresponds to the state of a cluster or region-level key when CMEK is in the process of being revoked.
- REVOKE_FAILED: REVOKE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be revoked.
Available options:
DISABLED, DISABLING, DISABLE_FAILED, ENABLED, ENABLING, ENABLE_FAILED, ROTATING, ROTATE_FAILED, REVOKED, REVOKING, REVOKE_FAILED