Set up BYOK with Yandex KMS

1. Open the Yandex KMS console

2. Go to Identity and Access Management and click Create service account

3. Give the service account a name and assign it the kms.keys.encrypterDecrypter role

4. Open the service account you created for editing and click Create new key. Select Create authorized key with the RSA-2048 encryption algorithm

5. Download the key file

6. Paste the contents of the downloaded file into Pachca. This is your JSON key for authorizing with the encryption system

{
  "id": "ajeobp8qi8slm13qe4fv",
  "service_account_id": "...",
  "created_at": "...",
  "key_algorithm": "RSA_2048",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIB...",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhki..."
}

7. In Key Management System, go to Symmetric keys and click Create key

8. Select the AES-128 encryption algorithm and leave the rotation period empty

9. In the key's access permissions, specify the service account with the kms.keys.encrypterDecrypter role

10. Copy the ID of the key you created and enter it in Pachca in the KMS Key ID field

11. Click Enable encryption

Advanced data encryption is now turned on in your Pachca workspace.