Skip to content

Commit 2ee29a5

Browse files
committed
docs(key-manager): add info about petry + feedback cyril
1 parent 3dadd46 commit 2ee29a5

File tree

2 files changed

+25
-15
lines changed

2 files changed

+25
-15
lines changed

identity-and-access-management/key-manager/api-cli/create-dek-api-cli.mdx

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ An output similar to the following should display:
4848
CreatedAt <creation_date>
4949
```
5050

51+
<Message type="important">
52+
For convenience, Key Manager returns the plaintext version of the DEK, but it should never be stored in this form. Storing the decrypted plaintext of your DEK undermines the security provided by Key Manager, rendering it ineffective.
53+
</Message>
5154

5255
## Generate a DEK using the API
5356

@@ -65,7 +68,7 @@ Key Manager also supports the `GenerateDataKey` request without a plaintext oper
6568

6669
If you need to use your DEK, you can decrypt it using the [Decrypt data operation](https://www.scaleway.com/en/developers/api/key-manager/#path-keys-decrypt-data) specifying the `kek_id` parameter used to encrypt it.
6770

68-
Key Manager **does not allow the use of data encryption keys for data encryption**.
71+
**Key Manager does not handle direct data encryption**. It is specifically designed to **encrypt and decrypt Data Encryption Keys (DEKs) and is limited to processing inputs up to 64KB in size**.
6972

7073
However, you can use the DEK independently from Key Manager, for example with the [Tink extension](/encrypt-decrypt-dek-/#encrypt-and-decrypt-data-with-tink-and-key-manager) or with [OpenSSL](/encrypt-decrypt-dek/#manually-encrypt-and-decrypt-data-with-a-key-manager-dek).
7174

identity-and-access-management/key-manager/api-cli/encrypt-decrypt-data-with-km-dek.mdx

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
---
22
meta:
33
title: Encrypting and decrypting data with a Key Manager data encryption key
4-
description: Learn how to use Tink with Scaleway's Key Manager to securely encrypt and manage keys, including KEKs and DEKs, in Go applications.
4+
description: Learn how to use Tink with Scaleway's Key Manager to securely encrypt and manage keys, including KEKs and DEKs, in Go and Python applications.
55
content:
66
h1: Encrypting and decrypting data with a Key Manager data encryption key
7-
paragraph: Learn how to use Tink with Scaleway's Key Manager to securely encrypt and manage keys, including KEKs and DEKs, in Go applications.
7+
paragraph: Learn how to use Tink with Scaleway's Key Manager to securely encrypt and manage keys, including KEKs and DEKs, in Go and Python applications.
88
tags: key-manager encryption decryption kms dek data-encryption-key
99
dates:
10-
validation: 2025-01-06
11-
posted: 2025-01-06
10+
validation: 2025-01-20
11+
posted: 2025-01-20
1212
categories:
1313
- identity-and-access-management
1414
---
@@ -23,8 +23,11 @@ This page shows you how to encrypt and decrypt data using your Key Manager [data
2323
- Retrieved your key encryption key's ID
2424
- A valid [API key](/identity-and-access-management/iam/how-to/create-api-keys/)
2525
- Downloaded and configured the [Scaleway CLI](https://github.com/scaleway/scaleway-cli?tab=readme-ov-file#getting-started)
26-
- [Dowloaded and installed Python](https://www.python.org/downloads/) or [Go](https://go.dev/doc/install)
26+
- [Dowloaded and installed Python](https://www.python.org/downloads/) version >=3.9 or [Go](https://go.dev/doc/install)
2727
- [Created a Key Manager data encryption key](/identity-and-access-management/key-manager/how-to/create-manage-dek/)
28+
- [Installed Poetry](https://python-poetry.org/docs/#installation)
29+
- [Created a project](https://python-poetry.org/docs/basic-usage/#project-setup) in Poetry
30+
- [Set a Python version](https://python-poetry.org/docs/basic-usage/#setting-a-python-version) in your Petry project
2831

2932
## Encrypt and decrypt data with Tink and Key Manager
3033

@@ -61,20 +64,24 @@ Open a terminal and paste the following command to export your environment varia
6164

6265
### Using the Python Tink provider
6366

64-
1. Open a terminal and install [Poetry](https://python-poetry.org/):
67+
1. Open a terminal and access your desired Poetry project:
68+
69+
```
70+
cd your-project
71+
```
6572

66-
```bash
67-
curl -sSL https://install.python-poetry.org | python3 -
68-
```
6973
<Message type="note">
7074
Poetry is used to manage dependencies. You can however use any package management tool of your choice. For more information on managing dependencies, refer to the [official Python documentation](https://packaging.python.org/en/latest/tutorials/managing-dependencies/).
7175
</Message>
72-
73-
2. Add the [Scaleway Tink provider for Python](https://github.com/scaleway/tink-py-scwkms/tree/v0.1.0):
76+
2. Initialize your project:
77+
```
78+
poetry init
79+
```
80+
3. Add the [Scaleway Tink provider for Python](https://github.com/scaleway/tink-py-scwkms/tree/v0.1.0):
7481
```bash
7582
poetry add scaleway-tink
7683
```
77-
3. Copy the following template:
84+
4. Copy the following template:
7885
```bash
7986
from scaleway_tink.integration.scwkms import clientimport base64
8087
import base64
@@ -93,9 +100,9 @@ Open a terminal and paste the following command to export your environment varia
93100

94101
main()
95102
```
96-
4. Create a file named `example.py` and paste the code from the step above in it.
103+
5. Create a file named `example.py` and paste the code from the step above in it.
97104

98-
5. Run your code:
105+
6. Run your code:
99106
```bash
100107
python3 ./example.py
101108
```

0 commit comments

Comments
 (0)