chore(byok): Detailed guide on creating AWS KMS key, add downloadable files #7019

stathis-cmnd · 2025-10-09T16:03:17Z

Description

Detailed docs on how to create a AWS KMS key for the BYOK integration.
Add downloadable files.

Links to this docs will be used in the console integration for downloading scripts and providing customers with technical documentation

When should this change go live?

This is a bug fix, security concern, or something that needs urgent release support. (add bug or support label)
This is already available but undocumented and should be released within a week. (add available & undocumented label)
This is on a specific schedule and the assignee will coordinate a release with the Documentation team. (create draft PR and/or add hold label)
This is part of a scheduled alpha or minor. (add alpha or minor label)
There is no urgency with this change (add low prio label)

PR Checklist

The commit history of this PR is cleaned up, using {type}(scope): {description} commit message(s)

My changes are for an upcoming minor release and are in the /docs directory (version 8.8).
My changes are for an already released minor and are in a /versioned_docs directory.

I added a DRI, team, or delegate as a reviewer for technical accuracy and grammar/style:
- Engineering team review
- Technical writer review via @camunda/tech-writers unless working with an embedded writer.

CLAassistant · 2025-10-09T16:03:24Z

All committers have signed the CLA.

github-actions · 2025-10-09T16:04:11Z

👋 🤖 🤔 Hello, @stathis-cmnd! Did you make your changes in all the right places?

These files were changed only in docs/. You might want to duplicate these changes in versioned_docs/version-8.7/.

docs/components/saas/byok/create-byok-aws-kms-key.md
docs/components/saas/byok/downloads/aws-kms-key-policy.json
docs/components/saas/byok/downloads/create-byok-kms-key-multi-region.sh
docs/components/saas/byok/downloads/create-byok-kms-key-single-region.sh

You may have done this intentionally, but we wanted to point it out in case you didn't. You can read more about the versioning within our docs in our documentation guidelines.

github-actions · 2025-10-09T16:05:59Z

docs/components/saas/byok/create-byok-aws-kms-key.md

+*   Outputs the key ARN for you to provide to Camunda.
+
+**Instructions:**
+1.  Download the script: [create-byok-kms-key-single-region.sh](https://docs.camunda.io/docs/next/components/saas/byok/downloads/create-byok-kms-key-single-region.sh).


⚠️ [vale] _{reported by reviewdog 🐶}
[all.markdownLinksDontExitToProduction] Improper link format: [create-byok-kms-key-single-region.sh](https://docs.camunda.io/docs/next/components/saas/byok/downloads/create-byok-kms-key-single-region.sh). Please use relative URLs.

github-actions · 2025-10-09T16:05:59Z

docs/components/saas/byok/create-byok-aws-kms-key.md

+*   Outputs both key ARNs for you to provide to Camunda.
+
+**Instructions:**
+1.  Download the script: [create-byok-kms-key-multi-region.sh](https://docs.camunda.io/docs/next/components/saas/byok/downloads/create-byok-kms-key-multi-region.sh).


⚠️ [vale] _{reported by reviewdog 🐶}
[all.markdownLinksDontExitToProduction] Improper link format: [create-byok-kms-key-multi-region.sh](https://docs.camunda.io/docs/next/components/saas/byok/downloads/create-byok-kms-key-multi-region.sh). Please use relative URLs.

github-actions · 2025-10-09T16:05:59Z

docs/components/saas/byok/create-byok-aws-kms-key.md

+> before creating the second key.
+
+**Script Reference:** 
+For creating AWS KMS single-region key Download and run [create-byok-kms-key-single-region.sh](https://docs.camunda.io/docs/next/components/saas/byok/downloads/create-byok-kms-key-single-region.sh)


⚠️ [vale] _{reported by reviewdog 🐶}
[all.markdownLinksDontExitToProduction] Improper link format: [create-byok-kms-key-single-region.sh](https://docs.camunda.io/docs/next/components/saas/byok/downloads/create-byok-kms-key-single-region.sh). Please use relative URLs.

github-actions · 2025-10-09T16:05:59Z

docs/components/saas/byok/create-byok-aws-kms-key.md

+
+**Script Reference:** 
+For creating AWS KMS single-region key Download and run [create-byok-kms-key-single-region.sh](https://docs.camunda.io/docs/next/components/saas/byok/downloads/create-byok-kms-key-single-region.sh)
+For creating AWS KMS multi-region keys Download and run [create-byok-kms-key-multi-region.sh](https://docs.camunda.io/docs/next/components/saas/byok/downloads/create-byok-kms-key-multi-region.sh)


⚠️ [vale] _{reported by reviewdog 🐶}
[all.markdownLinksDontExitToProduction] Improper link format: [create-byok-kms-key-multi-region.sh](https://docs.camunda.io/docs/next/components/saas/byok/downloads/create-byok-kms-key-multi-region.sh). Please use relative URLs.

github-actions · 2025-10-09T16:05:59Z

docs/components/saas/byok/create-byok-aws-kms-key.md

+
+6.  **Edit Key Policy**
+   *   On the review screen, find the **Key policy** section and click **Switch to policy view**.
+   *   Add to or replace with the [key policy](https://docs.camunda.io/docs/next/components/saas/byok/downloads/aws-kms-key-policy.json) we provide to you


⚠️ [vale] _{reported by reviewdog 🐶}
[all.markdownLinksDontExitToProduction] Improper link format: [key policy](https://docs.camunda.io/docs/next/components/saas/byok/downloads/aws-kms-key-policy.json). Please use relative URLs.

stathis-cmnd · 2025-10-09T16:13:23Z

@christinaausley this is a detailed guide on how to create the KMS keys. Links to this doc will be used to support the console operations i.e. links from the console around BYOK should lead in this doc. In addition we can use it as direct reference and link it to https://github.com/camunda/camunda-docs/pull/6634/files#diff-190963c5b7bc0e62f2648f199626a6d28c8b70684b8e50825efce41f5c1f752fR43 Instead of adding the instructions there

The PR also includes the downloaded files the customers can download through the console.

Could you please give your feedback if you agree with this doc and if it needs formation changes? Thank you

cc @Sijoma

github-actions · 2025-10-09T16:22:23Z

docs/components/saas/byok/create-byok-aws-kms-key.md

+
+6.  **Edit Key Policy**
+   - On the review screen, find the **Key policy** section and click **Switch to policy view**.
+   - Add to or replace with the [key policy](https://docs.camunda.io/docs/next/components/saas/byok/downloads/aws-kms-key-policy.json) we provide to you


⚠️ [vale] _{reported by reviewdog 🐶}
[all.markdownLinksDontExitToProduction] Improper link format: [key policy](https://docs.camunda.io/docs/next/components/saas/byok/downloads/aws-kms-key-policy.json). Please use relative URLs.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

github-actions · 2025-10-09T16:46:31Z

docs/components/saas/byok/create-byok-aws-kms-key.md

+- Charges for KMS Key storage will appear on your AWS bill
+- Charges for KMS API calls will appear on Camunda's AWS bill
+- **For single region the KMS key must be created in the eu-west-1 (Ireland) region**
+- **For dual-region backup, the primary key must be in eu-west-1 (Ireland) and the replica/secondary key in a eu-west-2 (London)**


[prettier] _{reported by reviewdog 🐶}

Suggested change

- **For dual-region backup, the primary key must be in eu-west-1 (Ireland) and the replica/secondary key in a eu-west-2 (London)**

- **For dual-region backup, the primary key must be in eu-west-1 (Ireland) and the replica/secondary key in a eu-west-2 (London)**

christinaausley · 2025-10-09T17:04:30Z

@stathis-cmnd I noticed that this new create-byok-aws-kms-key.md page overlaps quite a bit with the existing aws-external-encryption-setup.md.

Since both guides walk the user through creating and configuring AWS KMS keys for BYOK, it might make sense to merge them into a single, structured flow (e.g., in docs/components/saas/byok/aws-kms-setup.md) to reduce duplication and clarify the end-to-end process:

Cluster creation and external encryption setup
KMS key creation (CLI or manual)
Key policy configuration
Key association with the cluster
Verification and monitoring

This would give users one place to follow the full workflow and make maintenance easier over time.
WDYT? I am happy to do this if agreed on.

stathis-cmnd · 2025-10-10T09:32:10Z

@christinaausley yes that is actually the case. We had in another repo the guides and instructions provided/written by Philipp from AWS. I changed them a bit to be compatible with our use case. So the idea is to merge them in one doc and single source of truth. If you can to the merging that would be great. Thank you

christinaausley · 2025-10-13T21:11:02Z

@mesellings As far as the downloads here, how do you want cases like these handled in the docs? Kept in the docs, and just link to the repo location, or in a separate repo entirely? Alternatively we can incorporate them as details elements, as done with https://github.com/camunda/camunda-docs/pull/6634/files currently.

christinaausley · 2025-10-15T21:43:21Z

Closing as this was incorporated with https://github.com/camunda/camunda-docs/pull/6634/files.

chore(byok): Deatiled guide on creating AWS KMS key

b341b77

github-actions bot assigned stathis-cmnd Oct 9, 2025

github-actions bot reviewed Oct 9, 2025

View reviewed changes

chore(byok): Deatiled guide on creating AWS KMS key - fmt

2cf2620

github-actions bot reviewed Oct 9, 2025

View reviewed changes

stathis-cmnd and others added 8 commits October 9, 2025 18:24

chore(byok): Deatiled guide on creating AWS KMS key - use relative links

9c18c43

chore(byok): Deatiled guide on creating AWS KMS key - fmt

104af3d

Merge branch 'main' into byok-aws-create-key

65af0bb

chore(byok): Deatiled guide on creating AWS KMS key - fmt

c90ed6d

Update docs/components/saas/byok/create-byok-aws-kms-key.md

b89b585

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update docs/components/saas/byok/create-byok-aws-kms-key.md

c569c22

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update docs/components/saas/byok/create-byok-aws-kms-key.md

e4ccd93

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update docs/components/saas/byok/create-byok-aws-kms-key.md

c769937

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

github-actions bot reviewed Oct 9, 2025

View reviewed changes

christinaausley closed this Oct 15, 2025

	- For dual-region backup, the primary key must be in eu-west-1 (Ireland) and the replica/secondary key in a eu-west-2 (London)
	- For dual-region backup, the primary key must be in eu-west-1 (Ireland) and the replica/secondary key in a eu-west-2 (London)

chore(byok): Detailed guide on creating AWS KMS key, add downloadable files #7019

chore(byok): Detailed guide on creating AWS KMS key, add downloadable files #7019

Uh oh!

Conversation

stathis-cmnd commented Oct 9, 2025

Description

When should this change go live?

PR Checklist

Uh oh!

CLAassistant commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 9, 2025

Uh oh!

github-actions bot Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

stathis-cmnd commented Oct 9, 2025

Uh oh!

github-actions bot Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

christinaausley commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stathis-cmnd commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christinaausley commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christinaausley commented Oct 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CLAassistant commented Oct 9, 2025 •

edited

Loading

christinaausley commented Oct 9, 2025 •

edited

Loading

stathis-cmnd commented Oct 10, 2025 •

edited

Loading

christinaausley commented Oct 13, 2025 •

edited

Loading