Topics:

• Steps to Use Your Own Encryption Key with Oracle Logging Analytics

• List Storage Encryption Keys

• Rotate Storage Encryption Keys

• Useful Tips for Rotating Your Encryption Keys in Oracle Logging Analytics

• Switch Back to Oracle-managed Encryption

Steps to Use Your Own Encryption Key with Oracle Logging Analytics

By following these steps, you can successfully use your own encryption key in Oracle Logging Analytics, confirm existing keys, and monitor their assignment using oci cli commands:

1. Request feature enablement:

   Contact Oracle Support to enable the Customer-Provided Encryption Key feature for your tenancy. File a Service Request (SR) from Oracle Cloud Support Portal.

   Proceed to the next steps only after Oracle confirms that the feature is enabled.

2. Create or select encryption key in OCI Vault:

   Navigate to OCI Security, and select Vault. Select or create a vault, then create or select the key to use. Using OCI Vault, you can manage vaults, keys and secrets. See Oracle Cloud Infrastructure Documentation: Managing Keys.

   Note
   
   

   Use only 256-bit Advanced Encryption Standard (AES-256) encryption key for Block Volumes (Active storage data). See Block Volume Encryption Keys.

3. Note your encryption key information:

   Locate and copy the OCID of your selected key in the Vault, the Vault compartment OCID, and the compartment OCID in which the key is located for use in the next steps.

4. Configure required IAM policies:

   Ensure that the required IAM policy statements are created for key management, accessing data from your dedicated resources, and allowing Oracle Logging Analytics to use your encryption key on your logs. See Allow the Use of Customer-Provided Keys for Encrypting Logs.

5. Assign your key to Oracle Logging Analytics storage:

   Assign your key with a oci cli request.

   oci log-analytics storage assign-encryption-key --key-id <key-id> --key-type <key_type> --namespace-name <namespace_name>

   • Replace <key-id> with the OCID of your encryption key.
   • Set <key_type> as "ACTIVE_DATA" for active storage, or "ARCHIVAL_DATA" for archival storage.
   • Replace <namespace_name> with your tenancy namespace name.

   Note the work request ID from the response to the above command.

   For more details about the CLI command, parameters, and examples, see assign-encryption-key.

6. Monitor the encryption key assignment status:

   To track progress, use the work request ID from the response above:

   oci log-analytics storage get-storage-work-request --namespace-name <namespace_name> --work-request-id <work_request_id>

   • Replace <work_request_id> with the ID returned from the assign-encryption-key oci cli call.
   • Replace <namespace_name> with your tenancy namespace name.
   • Review the response for status and details. The key assignment is complete when the response status is SUCCEEDED.

   For more details about the CLI command, parameters, and examples, see get-storage-work-request.

   Sample response:

   {
     "compartmentId": "ocid1.tenancy.oc1..xxxxx",
     "id": "ocid1.loganalyticsstorageworkrequest.oc1.xxxxx",
     "operationDetails": "Encryption Completed",
     "operationType": "ENCRYPT_ACTIVE_DATA",
     "percentComplete": 100,
     "status": "SUCCEEDED",
     "statusDetails": "ENCRYPTED",
     "timeAccepted": "2025-05-30T18:29:05.153+00:00",
     "timeExpires": null,
     "timeFinished": "2025-05-30T18:30:27.980+00:00",
     "timeStarted": "2025-05-30T18:30:23.054+00:00"
   }

After the feature is enabled, your older log data which resides in a different location will continue to be encrypted using OCI managed encryption keys. All new data coming after the enabling will be encrypted using your own encryption key.

List Storage Encryption Keys

You can check which encryption keys are associated with your Oracle Logging Analytics tenancy at any time:

oci log-analytics storage list-encryption-key-info --namespace-name <namespace_name>

Replace <namespace_name> with your tenancy namespace name.

Sample JSON response:

[
  {
    "keyId": "ocid1.key.oc1..xxxxx",
    "keySource": "CUSTOMER_MANAGED",
    "keyType": "ACTIVE_DATA"
  },
  {
    "keyId": "ocid1.key.oc1..xxxxx",
    "keySource": "CUSTOMER_MANAGED",
    "keyType": "ARCHIVAL_DATA"
  }
]

For more details about the CLI command, parameters, and examples, see list-encryption-key-info.

Rotate Storage Encryption Keys

Periodically rotating your encryption keys is a best practice for strengthening data security. In Oracle Logging Analytics, you can rotate your key by assigning a new one using the assign-encryption-key oci cli command. The steps below show how to rotate your key, monitor progress, and clean up the old key when the process is complete.

1. Prepare your new encryption key:

   Generate or select a new encryption key in OCI Vault.

   Note
   
   

   Use only 256-bit Advanced Encryption Standard (AES-256) encryption key for Block Volumes (Active storage data). See Block Volume Encryption Keys.

   Ensure that Oracle Logging Analytics has the necessary IAM policies to use the new key. See Allow the Use of Customer-Provided Keys for Encrypting Logs.

2. Assign your key to Oracle Logging Analytics storage:

   Assign your key with a oci cli request.

   oci log-analytics storage assign-encryption-key --key-id <key-id> --key-type <key_type> --namespace-name <namespace_name>

   • Replace <key-id> with the OCID of your encryption key.
   • Set <key_type> as "ACTIVE_DATA" for active storage, or "ARCHIVAL_DATA" for archival storage.
   • Replace <namespace_name> with your tenancy namespace name.

   For more details about the CLI command, parameters, and examples, see assign-encryption-key.

3. Monitor the encryption key assignment status:

   To track progress, use the work request ID from the response above:

   oci log-analytics storage get-storage-work-request --namespace-name <namespace_name> --work-request-id <work_request_id>

   • Replace <work_request_id> with the ID returned from the assign-encryption-key oci cli call.
   • Replace <namespace_name> with your tenancy namespace name.
   • Review the response for status and details. The key assignment is complete when the response status is SUCCEEDED.

   For more details about the CLI command, parameters, and examples, see get-storage-work-request.

   Sample response:

   {
     "compartmentId": "ocid1.tenancy.oc1..xxxxx",
     "id": "ocid1.loganalyticsstorageworkrequest.oc1.xxxxx",
     "operationDetails": "Encryption Completed",
     "operationType": "ENCRYPT_ACTIVE_DATA",
     "percentComplete": 100,
     "status": "SUCCEEDED",
     "statusDetails": "ENCRYPTED",
     "timeAccepted": "2025-05-30T18:29:05.153+00:00",
     "timeExpires": null,
     "timeFinished": "2025-05-30T18:30:27.980+00:00",
     "timeStarted": "2025-05-30T18:30:23.054+00:00"
   }

4. Remove the old key:

   Ensure that rotation is complete by verifying that the response to the get-storage-work-request call is SUCCEEDED. After verifying that list-encryption-key-info call now shows only the new key, you may safely remove the old key from OCI Vault. See List Storage Encryption Keys.

Useful Tips for Rotating Your Encryption Keys in Oracle Logging Analytics

• Both keys are needed during rotation

  When you start key rotation, both the old and new keys must remain active and accessible. The old key ensures that existing encrypted data can be read and re-encrypted with the new key.

• Add a new key to start rotation

  Begin rotation by adding your new encryption key using the assign-encryption-key oci cli command. See Rotate Storage Encryption Keys.

• No mandatory waiting period after rotation completes

  You do not have to wait a set number of days. Once key rotation is completed, the old key is no longer needed and can be safely removed from OCI Vault.

• Rotation duration

  • If Archiving is not enabled:

    ACTIVE_DATA key type: Both active data and active data backup are encrypted with the specified key and both are rotated. Rotation of active data backup can typically take 1TB = hours, 10TB = days, 100TB = weeks. The more data you have, the longer rotation may take.

  • If Archiving is enabled:

    ACTIVE_DATA key type: Only active data key is rotated. The impact of active data size (10TB, 20TB, 100TB) is not very significant. Rotation typically completes quickly (in minutes to an hour), regardless of data size.

    ARCHIVAL_DATA key type: Only archival data key is rotated. Rotation of archival data can typically take 1TB = hours, 10TB = days, 100TB = weeks. The more data you have, the longer rotation may take.

• No fixed retention time for old key

  • The old key must be kept until all data is re-encrypted with the new key and the rotation is confirmed complete.

• How to monitor rotation progress

  The assign encryption key operation is asynchronous. After submitting your key rotation request, track progress using the returned workRequestId.

  See Rotate Storage Encryption Keys.

  When the work request completes successfully with the status SUCCEEDED and list-encryption-key-info call now shows only the new key, it’s safe to delete the old key. If the work request fails, review the response to determine the reason for failure and incorporate the fix. For help, contact Oracle Support.

• Verify which key is active

  List current encryption keys to confirm the new key is in use.

  See List Storage Encryption Keys.

  Ensure that the old key is no longer listed before removal.

• Keep both keys accessible

  Do not delete or disable the old key until rotation has fully completed and validated. Losing access to the old key during rotation can lead to data access issues.

• Test with smaller data first

  If possible, consider a test rotation on a smaller data set to estimate timing in your OCI environment.

In summary, keep both keys available during rotation, monitor rotation through work request status, remove the old key only after completion, and expect archive rotation to take longer as data size increases. Always verify key status before cleanup.

Switch Back to Oracle-managed Encryption

If you are facing scalability/ performance issues due to key rotation or if you're unable to maintain the key management process, then you may want to switch back to Oracle-managed encryption. Contact Oracle Support to switch back to Oracle-managed encryption for your tenancy. File a Service Request (SR) from Oracle Cloud Support Portal.