Enable or update the CMEK spec for a cluster

curl --request PUT \ --url https://cockroachlabs.cloud/api/v1/clusters/{cluster_id}/cmek \ --header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \ --json '{"region_specs":[{"key_spec":{"auth_principal":"arn:aws:iam::account:role/role-name-with-path","type":"AWS_KMS","uri":"arn:aws:kms:us-west-2:111122223333:key/id-of-kms-key"},"region":"us-central1"}]}'

{ "region_infos": [ { "key_infos": [ { "created_at": "2023-11-07T05:31:56Z", "spec": { "auth_principal": "<string>", "uri": "<string>" }, "updated_at": "2023-11-07T05:31:56Z", "user_message": "<string>" } ], "region": "<string>" } ] }

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

cluster_id

string

required

Body

application/json

region_specs

object[]

required

Show child attributes

Response

A successful response.

CMEKClusterInfo contains the status of CMEK across an entire cluster, including within each one its regions.

region_infos

object[]

Show child attributes

status

enum<string>

CMEKStatus describes the current status of CMEK for an entire CRDB cluster or a CMEK key within a region.

DISABLED: DISABLED corresponds to the state of a cluster or region-level key when CMEK has finished being disabled. By default, CMEK will be disabled for new clusters.
DISABLING: DISABLING corresponds to the state of a cluster or region-level key when CMEK is in the process of being disabled.
DISABLE_FAILED: DISABLE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be disabled.
ENABLED: ENABLED corresponds to the state of a cluster or region-level key when CMEK is enabled.
ENABLING: ENABLING corresponds to the state of a cluster or region-level key when CMEK is in the process of being enabled.
ENABLE_FAILED: ENABLE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be enabled.
ROTATING: ROTATING corresponds to the state of a cluster or region when the a new spec is in the process of being enabled while an existing spec is being disabled.
ROTATE_FAILED: ROTATE_FAILED corresponds to the state of a cluster or region if there was a failure to update from one CMEK spec to another.
REVOKED: REVOKED corresponds to the state of a cluster or region-level key when the customer has revoked CockroachLab's permissions for their key.
REVOKING: REVOKING corresponds to the state of a cluster or region-level key when CMEK is in the process of being revoked.
REVOKE_FAILED: REVOKE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be revoked.

Available options:

DISABLED,

DISABLING,

DISABLE_FAILED,

ENABLED,

ENABLING,

ENABLE_FAILED,

ROTATING,

ROTATE_FAILED,

REVOKED,

REVOKING,

REVOKE_FAILED

Overview

Endpoints

Enable or update the CMEK spec for a cluster

Authorizations

Path Parameters

Body

Response