Appian Cloud Disk Encryption

Overview

Disk encryption protects information stored on computer disks by encrypting every bit of data. It transforms human-readable information on the drive to unreadable, seemingly randomized characters. If an encrypted disk is lost or stolen, the disk remains encrypted, and only authorized users are able to access and decipher its contents.

This page provides information about standard disk encryption for Appian Cloud. It also documents the Bring Your Own Key (BYOK) feature for customers on Professional or Signature Success Plans who want to manage their own encryption keys.

Appian Cloud also offers database encryption for customers who want to add an extra layer of encryption at the database level.

Appian Cloud standard disk encryption

Appian uses full disk encryption in Appian Cloud. Data at rest is protected for Appian Cloud environments at the disk level using industry standard algorithms, such as AES, at key lengths considered to be strong for that algorithm. For example, 128-bit or 256-bit.

Disk encryption covers all data stored on disk in Appian by all Appian features. All the disks that contain your data will be encrypted and their encryption keys stored in a secured location within Appian Cloud.

Bring Your Own Key for Professional or Signature customers

Appian Cloud provides Bring Your Own Key (BYOK) for disk encryption and other data services using AWS Key Management System (KMS). With BYOK, you have decryption control of the disk and data services that contain your data. This page provides a summary of the offering and procedural steps to guide you through the process.

Architecture

In this configuration, Appian Cloud utilizes your KMS key in two ways:

1. Generating KMS data key to use for encryption of your data.
2. Decrypting the generated data key.

Appian Cloud leverages the KMS API to generate a data key using your provided KMS. This data key is used to encrypt your data. All encryption operations occur in the Appian Cloud environments that store your data. Invocation of the KMS API to generate and decrypt the data key also occurs in the Appian Cloud environments. Upon enabling BYOK for your site, Appian will programmatically generate a data key and store the encrypted copy in a secure credential store within Appian Cloud.

Managing Key Material

KMS provides various options to manage the key material origin, including KMS managed and generated, AWS CloudHSM, importing key material, and using an external key store. All options are supported for the KMS key used with BYOK.

For example, customers that want to use their own Hardware Security Model (HSM) outside of AWS need to use the importing key material options available in KMS. Appian Cloud does not integrate directly with your HSM. Customers must configure and set up their own KMS key to be provided to Appian for BYOK.

When rotating imported key material, customers must maintain all previous key material used for their BYOK key and cannot allow any key material to expire. On-demand rotation with KMS allows for changing a KMS key's current key material, which is used for encryption and decryption of any new data. However, in order to decrypt data that was encrypted prior to rotation, the KMS key must retain access to old key material indefinitely.

Updates to Key Policies with IAM Roles

To enhance security, reliability, and support new features, Appian is transitioning from using IAM Users to using IAM Roles to access BYOK keys. This new architecture extends BYOK support beyond disk encryption to include other cloud data sources such as AWS S3, in order to support new Appian Cloud features such as Autoscaling Processes. To take advantage of these new capabilities, existing BYOK customers must update their key policies, as guided by Appian Technical Support. Note, that while Appian is transitioning to using IAM roles for key access, some encryption features such as Appian Cloud Database Encryption will continue IAM users.

Instructions to Enable BYOK

Steps	Description	Organizational Role
Create a support case	Open a support case with Appian Technical Support to enable Bring Your Own Key. Include the following information: Configuration option: AWS KMS	Support Contact
Generate policy statement	Appian Technical Support will provide you with the KMS key policy statement. This statement will need to be added to your created KMS key.	Appian Support
Creation of the KMS key	Once you have the key policy statement, engage your AWS Administrator to create a KMS key and add the provided key policy statement to it. The key must be symmetric and created in the same AWS region as your Appian Cloud environment. The key policy statement gives Appian permission to utilize your key to generate data keys and run decryption operations. Once the key has been created, post the Amazon Resource Number (ARN) into the Appian Cloud Support Case.	Your AWS Administrator

FAQ

How can I enable BYOK on my environments?

Please follow the prerequisites listed above. Contact Appian Technical Support with any questions.

Can BYOK be used on existing environments?

Yes, BYOK can be configured on existing environments. All data from the existing environment will need to be re-encrypted with the new encryption key, which requires close coordination with Appian Technical Support during the transition.

What are some of the benefits of using IAM Roles instead of IAM Users?

This new architecture provides the following benefits:

• Reduced Credential Exposure: IAM roles enable secure delegation of access without the need to handle or store permanent user credentials.
• Enhanced Security Posture: The temporary nature of role-based credentials and automatic rotation reduce the attack surface.
• Follows Principle of Least Privilege: Roles facilitate more effective implementation of the principle of least privilege by defining precise and temporary permissions.
• Improved Visibility and Auditing: Customers can audit the usage of their KMS keys using AWS CloudTrail.

Will I need to update my policy or make changes on my end again in the near-future?

The goal of this architecture change is to make BYOK easier to manage on the customer's end. By granting access to the Appian Cloud Organizational Unit, there should be few reasons for additional changes in the foreseeable future.

What happens if I can’t update my policy now to support the new key policy?

New features and services are being built to only support IAM Roles for BYOK access instead of IAM Users. Starting in the 25.3 release, there are new features like Autoscaling Processes, with more planned in the future, that you will not be able to take advantage of until you have updated your policy so that Appian can continue to protect your data with your KMS key.

Does Appian keep a copy of your encryption key?

Appian Cloud will only store the encrypted Data Encryption Key (DEK). If Appian is unable to unwrap or decrypt the DEK, Appian won't be able to decrypt your data and the environment will be unavailable.

What happens if the key is lost?

If the key is lost, all the data, including all backups, would be unrecoverable.

Does Appian request decryption of the DEK for every read/write operation?

No, decryption of the DEK is not necessary after the disk is open, which occurs on each startup of your environment. The decrypted DEK will remain in kernel memory for read and write operations.

Is key rotation supported?

Use of Amazon's built-in automatic KMS key rotation is supported for the AWS KMS configuration only. This type of rotation maintains access to the old key for decryption regardless of the rotation of the underlying material, and also maintains the same key metadata. Manual key rotation is not supported.

Feedback