TechPrufer
Get started
Pinecone
Pinecone logoPinecone · Feature trail

Customer-Managed Encryption Keys (CMEK) and Role-Based Access Control (RBAC)

1 post · Dec 2024

What this trail covers

Pinecone has introduced Customer-Managed Encryption Keys (CMEK) for enhanced data security and tenant isolation, allowing customers to manage their own encryption keys. This feature is enabled at the project level and impacts all indexes within that project. The system uses hierarchical encryption with Key Encryption Keys (KEKs) and Data Encryption Keys (DEKs) to maintain performance and security. Additionally, Pinecone has expanded Role-Based Access Control (RBAC) with API key roles, providing granular permissions for both control plane and data plane operations. CMEK is currently available on AWS, with Azure and GCP support planned. Private Endpoints for AWS PrivateLink are also generally available.

All Pinecone trails
  1. Strengthening security and increasing control with CMEK and API key rolesThis post details the implementation of Customer-Managed Encryption Keys (CMEK) and Role-Based Access Control (RBAC) with API key roles. For CMEK, it explains the hierarchical encryption system involving Key Encryption Keys (KEKs) and Data Encryption Keys (DEKs), the role of the encryption service in managing data at rest and in transit, and the process of accessing customer keys via AWS IAM roles. It also describes the key revocation experience and the benefits for compliance and visibility. For RBAC, it introduces six new roles, three for the control plane and three for the data plane, to provide more granular access control.