Oracle Cloud Infrastructure Documentation

Onboarding with External KMS

Steps required to onboard a third-party key management system for integration with OCI External Key Management Service (EKMS).

The EKMS onboarding process includes details about setting up network components, setting up a new user account, providing user permissions, configuring a private endpoint, and configuring both network policies and IAM policies for accessing vault and keys.

The following diagram is a workflow that shows the steps to onboard the EKMS feature:


External Key Management Service Onboarding

  1. Set up the third-party key management service for OCI EKMS. Use the OCI EKMS vendor API specifications to enable cryptographic operations.
  2. Expose a secure and reliable service endpoint for OCI EKMS vendor APIs, authenticated using JWT tokens issued by OCI Identity Cloud Service (IDCS). ​
  3. Establish network connectivity between OCI and the third-party KMS. See Deploying the External Key Manager.
  4. Set up a secure and reliable network connection between OCI EKMS and the third-party KMS. See Setting Up Networking Components and Setting up FastConnect for Colocation.
  5. Configure an OCI IDCS application to authenticate OCI EKMS with the third-party KMS. See Setting up TLS Connectivity and Setting Up Authentication and Authorization.
  6. Create an external vault and keys linked to the third-party KMS.
  7. Provision an external vault and associated keys within OCI that are integrated with the third-party KMS.
  8. Enable customer-managed keys for OCI resources.
  9. Configure OCI resources such as Object Storage buckets or Autonomous Database to use customer-managed keys from the external vault.
You can use the following tasks to manage onboarding tasks: