Docs: Refactor encryption docs (#44718)

* Docs: Refactor encryption docs * Rename enterprise encr * Remove envelope encr page * combine database encryption sections * fix reference * Fix link Co-authored-by: Mitchel Seaman <mitchel.seaman@gmail.com>
2022-02-02 15:02:57 +02:00
parent 07d207a3f0
commit 84ea13bf6c
9 changed files with 56 additions and 65 deletions
@@ -0,0 +1,35 @@
+++
+title = "Enterprise database encryption"
+description = "Grafana Enterprise database encryption"
+keywords = ["grafana", "enterprise", "database", "encryption", "documentation"]
+aliases = [""]
+weight = 130
+++
+
+# Grafana Enterprise database encryption
+
+If you are using Grafana Enterprise, you can integrate with a key management system (KMS) provider, and change Grafana’s cryptographic mode of operation from AES-CFB to AES-GCM.
+
+## Encrypting your database with a key from a Key Management System (KMS)
+
+You can choose to encrypt secrets stored in the Grafana database using a key from a KMS, which is a secure central storage location that is designed to help you to create and manage cryptographic keys and control their use across many services. When you integrate with a KMS, Grafana does not directly store your encryption key. Instead, Grafana stores KMS credentials and the identifier of the key, which Grafana uses to encrypt the database.
+
+Grafana integrates with the following key management systems:
+
+- [AWS KMS]({{< relref "/using-aws-kms-to-encrypt-database-secrets.md" >}})
+- [Azure Key Vault]({{< relref "/using-azure-key-vault-to-encrypt-database-secrets.md" >}})
+- [Google Cloud KMS]({{< relref "/using-google-cloud-kms-to-encrypt-database-secrets.md" >}})
+- [Hashicorp Key Vault]({{< relref "/using-hashicorp-key-vault-to-encrypt-database-secrets.md" >}})
+
+Refer to [Database encryption]({{< relref "../../administration/database-encryption.md" >}}) to learn more about how Grafana encrypts secrets in the database.
+
+## Changing your encryption mode to AES-GCM
+
+Grafana encrypts secrets using Advanced Encryption Standard in Cipher
+FeedBack mode (AES-CFB). You might prefer to use AES in Galois/Counter
+Mode (AES-GCM) instead, to meet your company’s security requirements or
+in order to maintain consistency with other services.
+
+To change your encryption mode, update the `algorithm` value in the
+`[security.encryption]` section of your Grafana configuration file.
+For details, refer to [Enterprise configuration]({{< relref "../enterprise-configuration.md#securityencryption" >}}).
@@ -1,19 +0,0 @@
-+++
-title = "KMS integration"
-description = ""
-keywords = ["grafana", "kms", "key management system integration"]
-weight = 1200
-+++
-
-# Key management systems (KMSs)
-
-You can choose to encrypt secrets stored in the Grafana database using a key from a KMS, which is a secure central storage location that is designed to help you to create and manage cryptographic keys and control their use across many services. When you integrate with a KMS, Grafana does not directly store your encryption key. Instead, Grafana stores KMS credentials and the identifier of the key, which Grafana uses to encrypt the database.
-
-Grafana integrates with the following key management systems:
-
- [AWS KMS]({{< relref "/using-aws-kms-to-encrypt-database-secrets.md" >}})
- [Azure Key Vault]({{< relref "/using-azure-key-vault-to-encrypt-database-secrets.md" >}})
- [Google Cloud KMS]({{< relref "/using-google-cloud-kms-to-encrypt-database-secrets.md" >}})
- [Hashicorp Key Vault]({{< relref "/using-hashicorp-key-vault-to-encrypt-database-secrets.md" >}})
-
-Refer to [Database encryption]({{< relref "../../administration/database-encryption.md" >}}) to learn more about how Grafana encrypts secrets in the database.