Customer Managed Keys in Adobe Experience Platform

Data stored on Adobe Experience Platform is encrypted at rest using system-level keys. If you are using an application built on top of Platform, you can opt to use your own encryption keys instead, giving you greater control over your data security.

This document provides a high-level overview of the process for enabling the Customer Managed Keys (CMK) feature in Platform across Azure and AWS, along with the prerequisite information required to complete these steps.

Prerequisites

To enable CMK, your platform’s hosting environment (Azure or AWS) must meet specific configuration requirements:

General prerequisites

To view and access the Encryption section in Adobe Experience Platform, you must have created a role and assigned the Manage Customer Managed Key permission to that role. Any user with the Manage Customer Managed Key permission can enable CMK for their organization.

For more information on assigning roles and permissions in Experience Platform, refer to the configure permissions documentation.

Azure-specific prerequisites

For Azure-hosted implementations, configure your Azure Key Vault with the following settings:

• Enable purge protection
• Enable soft-delete
• Configure access using Azure role-based access control

AWS-specific prerequisites

For AWS-hosted implementations, configure your AWS environment as follows:

• Ensure you have permissions to manage encryption keys using AWS Identity and Access Management (IAM). For details, see the IAM Policies for AWS KMS.
• Set up AWS KMS with support for CMK. Refer to the AWS KMS data encryption guide.

Process summary

Customer Managed Keys (CMK) is available through Adobe’s Healthcare Shield and Privacy and Security Shield offerings. On Azure, CMK is supported for both Healthcare Shield and Privacy and Security Shield. On AWS, CMK is supported only for Privacy and Security Shield and is not available for Healthcare Shield. Once your organization purchases a license for one of these offerings, you can begin the one-time setup process for enabling CMK.

The process is as follows:

For Azure

1. Configure an Azure Key Vault based on your organization’s policies, then generate an encryption key to share with Adobe.
2. Set up the CMK app with your Azure tenant through either API calls or the UI.
3. Send your encryption key ID to Adobe and start the enablement process for the feature, either in the UI or with an API call.
4. Check the status of the configuration to verify whether CMK has been enabled, either in the UI or with an API call.

Once the setup process is complete for Azure-hosted Platform instances, all data onboarded into Platform across all sandboxes will be encrypted using your Azure key setup. To use CMK, you will leverage Microsoft Azure functionality that may be part of their public preview program.

For AWS

1. Set up AWS KMS by configuring an encryption key to be shared with Adobe.
2. Follow the AWS-specific instructions in the UI setup guide.
3. Validate the setup to confirm that Platform data is encrypted using the AWS-hosted key.

Once the setup process is complete for AWS-hosted Platform instances, all data onboarded into Platform across all sandboxes will be encrypted using your AWS Key Management Service (KMS) configuration. To use CMK on AWS, you will use the AWS Key Management Service to create and manage your encryption keys in alignment with your organization’s security requirements.

Implications of revoking key access

Revoking or disabling access to the Key Vault, key, or CMK app in Azure or the encryption key in AWS can result in significant disruptions, that include breaking changes to your Platform’s operations. Once keys are disabled, data in Platform may become inaccessible, and any downstream operations that rely on this data will cease to function. It is crucial to fully understand the downstream impacts before making any changes to your key configurations.

To revoke Platform access to your data in Azure, remove the user role associated with the application from the Key Vault. For AWS, you can disable the key or update the policy statement. For detailed instructions on the AWS process, refer to the key revocation section.

Propagation timelines

After key access is revoked from your Azure Key Vault, the changes will propagate as follows:

For example, the Profile dashboard will continue to display data from its cache for up to seven days before the data expires and is refreshed. Similarly, re-enabling access to the application takes the same amount of time to restore data availability across these stores.

Next steps

To begin the process:

• For Azure: Start by configuring an Azure Key Vault and generate an encryption key to share with Adobe.
• For AWS: Set up AWS KMS and ensure proper IAM and KMS configurations before proceeding to the UI or API setup guides.