Migrate a KMS provider

When you configure your Boundary controller, you have to pick a KMS provider. Boundary supports different KMS providers, including AWS KMS, Azure Key Vault, GCP Cloud KMS, and IBM Vault. The KMS provider is the root of trust for the keys used for various encryption operations inside Boundary, like encrypting sensitive/secret data stored in the Boundary database, or encrypting the data used to authenticate a KMS worker to a controller.

There are several reasons to consider migrating from one KMS provider to another. For example, you may have set up the current KMS configuration in an account that you no longer want to use, or you want to migrate to a new KMS provider like IBM Vault.

Complete the following steps to migrate a KMS provider:

Update purpose in the existing KMS stanza in the Boundary configuration file to previous-root.

Current example configuration:

 kms "aead" {
   purpose   = "root"
   aead_type = "aes-gcm"
   key       = "sP1fnF5Xz85RrXyELHFeZg9Ad2qt4Z4bgNHVGtD6ung="
   key_id    = "global_root"
}

Updated example configuration:

 kms "aead" {
   purpose   = "previous-root"
   aead_type = "aes-gcm"
   key       = "sP1fnF5Xz85RrXyELHFeZg9Ad2qt4Z4bgNHVGtD6ung="
   key_id    = "global_root"
}

Add a new KMS stanza to the Boundary configuration file with the new KMS provider configuration.

Example configuration:

 kms "aead" {
   purpose   = "root"
   aead_type = "aes-gcm"
   key       = "sP1fnF5Xz85RrXyELHFeZg9Ad2qt4Z4bgNHVGtD6ung="
   key_id    = "new_global_root"
}

Restart the Boundary controller with the updated configuration file.
```
$ sudo systemctl restart boundary
```

Rotate and rewrap the keys using the new KMS provider.

$ boundary scopes rotate-keys -scope-id global -rewrap \
    boundary scopes rotate-keys -scope-id o_B4jfDjZ9jf -rewrap \
    boundary scopes rotate-keys -scope-id p_A4jfDjZ9jf -rewrap

Verify there are no decryption errors in the Boundary controller logs.
Remove the previous-root KMS stanza from the Boundary configuration file and restart Boundary.

Migrate a KMS provider

Additional resources