Appian Cloud Database Encryption

Overview

In addition to disk encryption, you can use database encryption to store your data in an encrypted state at rest in Appian Cloud. This option is only supported in Appian Cloud environments provisioned with MariaDB as the database.

This page explains how data-at-rest encryption works and how to enable it for your environment.

How database encryption works

When you enable database encryption, data is encrypted in real time before being written to disk, and decrypted when database queries are executed. As a result, no unencrypted data is persisted to disk. This provides another level of protection against unauthorized access to the filesystem or to the physical drives.

Appian Cloud leverages MariaDB's built-in data-at-rest encryption with the AWS key management and encryption plugin.

Data-at-rest encryption is also referred to as transparent data encryption (TDE) because it is transparent to the application layer. Queries from phpMyAdmin or other database clients will continue to show decrypted output. You do not need to make any application changes to use data-at-rest encryption.

Key management options

You can choose how to manage your encryption key based on your success plan and infrastructure needs:

• Appian-managed key: Available for Signature Success Plan customers. Appian automatically handles key management and rotations, so you do not need to manage a separate AWS account.
• Customer-managed key: You manage the encryption key using your own AWS Key Management Service (KMS) account. When your database starts, Appian requests your key from AWS. This allows you to audit every request and control database startup.

How encryption keys are used

The encryption key (whether Appian-managed or customer-managed) is used for two primary purposes:

• To generate the data encryption key (DEK): This occurs during the first startup of your database.

  

  Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

• To decrypt the DEK: This occurs on every subsequent database restart.

  

  Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Enable database encryption

To enable encryption on your Appian Cloud database:

1. Review the setup parameters to determine if you want to override the encryption strength or the default encryption for your tables.
2. Create a support case to request database encryption. In the case:
   • Specify whether you want an Appian-managed key or a customer-managed key.
   • Include any setup parameters you want to override.

Appian-managed key setup

If you requested an Appian-managed key, Appian Support will enable encryption and restart your environment. No further action is required on your part.

Customer-managed key setup

If you requested a customer-managed key, Appian Support will provide you with an IAM User ARN and a KMS key policy statement in the support case.

You must follow these additional steps to complete database encryption setup:

1. Contact your AWS Administrator to:
   1. Create a KMS Customer Master Key. The key must be a symmetric key and be created in the same AWS region as your Appian Cloud environment.
   2. Add the provided key policy statement to the Customer Master Key. The key policy statement will give Appian permission to utilize your key to generate data keys and run decryption operations.
2. In the support case, provide the Amazon Resource Name (ARN) of your Customer Master Key.

After these steps are complete, Appian Support will restart your environment to apply the encryption.

Setup parameters

Appian Cloud uses secure default settings when enabling database encryption. However, you can choose to override specific parameters to meet your organization's unique compliance or performance requirements.

When you request database encryption, you can specify overrides for the following parameters:

• Default encryption for tables: Controls whether all database tables are encrypted by default.
• Encryption algorithm: Controls the algorithm used to encrypt the data.

Default encryption for tables

This parameter controls whether tables are encrypted by default. If you do not specify a value for this parameter, Appian uses ON.

Valid parameter values are:

Value	Description	Recommended When
OFF	Tables are only encrypted when you create or alter them with the ENCRYPTED=YES option in a SQL statement. All other tables are unencrypted.	You want to encrypt specific tables, like those containing sensitive data.
ON (Default)	All tables are encrypted unless created or altered with the ENCRYPTED=NO option in a SQL statement. This value also encrypts existing tables.	You want to encrypt the entire database, except for a few specific tables.
FORCE	All tables are encrypted. Tables cannot be made unencrypted. This setting also encrypts existing tables.	You want to encrypt the entire database.

Encryption algorithm

This parameter controls the encryption algorithm. You can select AES 256 or AES 128. If you do not specify an algorithm, Appian uses AES 256.

Usage considerations

This section provides more information about managing your database encryption.

Key rotation

You can rotate both your data encryption key (DEK) and customer managed key (CMK):

• DEK rotation: You can rotate the DEK by executing a stored procedure in phpMyAdmin.
  • To rotate all keys, execute CALL AppianProcess.rotateEncryptionKey(-1).
  • To rotate a specific key, pass the key ID to the stored procedure instead of -1 in the expression above.

• CMK rotation: Appian supports Amazon's built-in automatic AWS CMK rotation. Automatic rotation maintains access to the old key for decryption and maintains the same key metadata. Manual key rotation is not supported.

  Caution:  If you need to remove an AWS CMK, Appian recommends disabling the key instead of deleting it. Deleting an AWS CMK will delete the key material and all associated metadata, and this action is irreversible. If encryption is not disabled prior to the CMK deletion, the encrypted data in your cloud database cannot be recovered.

Encryption of database logs

When database encryption is enabled, some logs are also encrypted:

• Binary log: Automatically produces output in an encrypted format.

• Audit log: Does not automatically produce an encrypted output. Instead, Appian encrypts the database audit log file hourly using your CMK. The Appian Cloud database requests log is disabled to ensure no data is kept on disk in plaintext.

• Error log: Does not automatically produce an encrypted output. Instead, Appian encrypts the database error log file hourly using your CMK.

Transport layer encryption

Data in transit between the Appian Cloud database and the clients is encrypted using the Transport Layer Security (TLS) protocol. No additional configuration is required.

Performance impact

A small performance impact is expected when encryption is enabled due to the processing required to encrypt and decrypt data. You should consider using data-at-rest encryption only when strictly required for your use case.

Disable encryption

To disable database encryption, open a support case. Your support contact will guide you through the process.

Feedback