Encryption
Learn which connections Bulutistan Cloud encrypts, where encryption at rest is available for your data, and which secrets are shown only once.
Encryption protects data while it moves between systems, in transit, and while it's stored, at rest. This article describes what Bulutistan Cloud encrypts, what you can encrypt, and what you need to encrypt yourself.
Encryption in transit
| Connection | How it's protected |
|---|---|
| Your browser to the console | HTTPS. The console tells browsers to reach its host and subdomains only over HTTPS for one year. Scripts on the page can't read the session cookie. |
| Your code to the REST API | HTTPS, when you send requests to the https:// address of your console. See REST API overview. |
| The browser console of an instance | An encrypted WebSocket connection when the console is open over HTTPS. The connection opens with a ticket that works once and expires after 60 seconds. |
| Webhook notifications | Only https:// addresses are accepted, and the receiver's certificate is checked against the address's host name. Each request is signed with HMAC-SHA256, so the receiver can check that it came from the platform. See Send alerts by email and webhook. |
| Your network to your projects | IPsec, through a Site-to-Site VPN tunnel. See the next section. |
VPN tunnels
A Site-to-Site VPN tunnel encrypts the traffic between your network and a project with IPsec. You choose the algorithms in the tunnel's IKE policy and IPsec policy. Both policies start with aes-256 encryption, sha256 authentication, and Diffie-Hellman group14, and the IPsec policy starts with the esp transform protocol.
For example, to keep traffic encrypted, keep esp or ah-esp as the transform protocol: ah authenticates the traffic but doesn't encrypt it. Prefer AES over 3des. For the policy settings, see Services, policies, endpoint groups, and site connections.
Encryption at rest
Volumes and images
Encryption at rest for volumes and images is available only where the region supports it; the console shows the option only there:
- Volumes. The region's block storage must have an encrypted volume type.
- Images. The region must have both an encrypted volume type and a key manager.
Through the REST API, a request for an encrypted volume or image in a region without that support is refused with 404 Not Found and a message that encryption at rest isn't available in the region. Nothing is created.
To check a volume, open it: the Encryption property shows what the cloud reports for the volume, Encrypted at rest or Not encrypted. A snapshot shows the same property. For details, see Encryption at rest for volumes and Images FAQ for images.
Data that you encrypt yourself
To keep data encrypted under your control, encrypt it before you store it, for example with disk or file system encryption in the instance's operating system, or before you upload objects. Keep the keys outside the platform.
Secrets that are shown once
| Secret | When it's shown |
|---|---|
| API token and service account key secrets | The secret is shown once, when it's created. |
| Webhook signing secrets | The secret is shown once, when you create the notification channel or rotate its secret. |
Copy a secret when it's shown, and keep it in a secrets manager.