Enable CMEK for a cluster.

POST /api/v1/clusters/{cluster_id}/cmek

cURL

cURL

curl --request POST \
  --url https://cockroachlabs.cloud/api/v1/clusters/{cluster_id}/cmek \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \
  --header 'content-type: application/json' \
  --data '{"region_specs":[{"region":"us-central1","key_spec":{"type":"AWS_KMS","uri":"arn:aws:kms:us-west-2:111122223333:key/id-of-kms-key","auth_principal":"arn:aws:iam::account:role/role-name-with-path"}}]}'

200

{
  "status": "UNKNOWN_STATUS",
  "region_infos": [
    {
      "region": "<string>",
      "key_infos": [
        {
          "status": "UNKNOWN_STATUS",
          "user_message": "<string>",
          "spec": {
            "type": "UNKNOWN_KEY_TYPE",
            "uri": "<string>",
            "auth_principal": "<string>"
          },
          "created_at": "2023-11-07T05:31:56Z",
          "updated_at": "2023-11-07T05:31:56Z"
        }
      ]
    }
  ]
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

cluster_id · string · required

Body

application/json

region_specs · object[] · required

Show child attributes

Response

200

application/json

A successful response.

CMEKClusterInfo contains the status of CMEK across an entire cluster, including within each one its regions.

status · enum<string> · default: UNKNOWN_STATUS

CMEKStatus describes the current status of CMEK for an entire CRDB cluster or a key within a region.

• UNKNOWN_STATUS: UNKNOWN should never be used; if it is used, it indicates a bug.
• DISABLED: DISABLED corresponds to the state of a cluster or region-level key when CMEK has finished being disabled. By default, CMEK will be disabled for new clusters.
• DISABLING: DISABLED corresponds to the state of a cluster or region-level key when CMEK is in the process of being disabled.
• DISABLE_FAILED: DISABLE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be disabled.
• ENABLED: ENABLED corresponds to the state of a cluster or region-level key when CMEK is enabled.
• ENABLING: ENABLING corresponds to the state of a cluster or region-level key when CMEK is in the process of being enabled.
• ENABLE_FAILED: ENABLE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be enabled.
• REVOKED: REVOKED corresponds to the state of a cluster or region-level key when the customer has revoked CockroachLab's permissions for their key.
• REVOKING: REVOKING corresponds to the state of a cluster or region-level key when CMEK is in the process of being revoked.
• REVOKE_FAILED: REVOKE_FAILED corresponds to the state of a cluster or region-level key when CMEK has failed to be revoked.

Available options: UNKNOWN_STATUS, DISABLED, DISABLING, DISABLE_FAILED, ENABLED, ENABLING, ENABLE_FAILED, REVOKED, REVOKING, REVOKE_FAILED

region_infos · object[]

Show child attributes