Custom EBS Volume Encryption

Dropzone provides a CloudFormation Template (CFT) to automatically create Key Management Service (KMS) keys with the permissions Dropzone needs to encrypt the elastic block storage (EBS) volumes that back your Dropzone instance. Providing your own keys allows you full control over your data with the ability to cut off Dropzone's access as you see fit.

The key in your primary instance region is used to encrypt all data on your Dropzone instance. Because KMS keys are only usable within the key's region, Dropzone requires a second key in the region used to maintain a remote copy of instance backups.

Each key is created with automatic rotation enabled. To prevent accidental deletions, each key is retained if the CloudFormation stack is ever deleted.

Download the CFT YAML using the following link: https://dropzone-public.s3.us-west-2.amazonaws.com/cloud-formation-templates/DropzoneAWSKeys_EBSVolumeKeys.yaml

An optional value for the AliasName value can be provided if you would like to change the default alias name given to the key.

Deploying the CloudFormation Template

Dropzone supports two methods of deployment: Command Line Interface (CLI) deployment or Manual.

The user/role used to deploy this CFT must have the following permissions in your AWS account:

Permission Name	Purpose
cloudformation:CreateChangeSet	Allows the user to execute the CreateChangeSet action
cloudformation:DescribeChangeSet	Allows the user to execute the DescribeChangeSet action
cloudformation:ExecuteChangeSet	Allows the user to execute the ExecuteChangeSet action
cloudformation:DescribeStacks	Allows the user to execute the DescribeStacks action
cloudformation:DescribeStackEvents	Allows the user to execute the DescribeStackEvents action
cloudformation:DescribeStackResources	Allows the user to execute the DescribeStackResources action
cloudformation:GetTemplate	Allows the user to execute the GetTemplate action
kms:CreateKey	Allows the user to create a unique KMS key
kms:DescribeKey	Allows the user to see the details of the KMS key
kms:PutKeyPolicy	Allows the user to attach a key policy to the KMS key
kms:EnableKeyRotation	Allows the user to enable automatic rotation of the KMS key material
kms:CreateAlias	Allows the user to create a user-friendly name for the KMS key
kms:UpdateAlias	Allows the user to associate an existing AWS KMS alias with a different KMS key
kms:DeleteAlias	Allows the user to delete the name of the KMS key

CLI Deployment

To complete CLI deployment, do the following:

• As an authenticated user with the required permissions and default AWS profile configured, cd into the directory where you downloaded the CFT

• Input the following text

# Replace xxxxxx with the region values provided by your Dropzone representative
INSTANCE_REGION=xxxxxx
BACKUP_REGION=xxxxxx

for region in $INSTANCE_REGION $BACKUP_REGION ; do
  aws cloudformation deploy --region "$region" \
    --template-file DropzoneAWSKeys_EBSVolumeKeys.yaml \
    --stack-name dropzone-ebs-key

  echo "$region $(aws cloudformation describe-stacks --region "$region" \
    --stack-name dropzone-ebs-key \
    --query 'Stacks[0].Outputs[?OutputKey==`KeyArn`].OutputValue' \
    --output text)"
done

• This should generate the key ARN values

• Send the lines with the key ARNs back to Dropzone to be applied to your instance

Manual Deployment

You will need to deploy the CFT twice, once in the instance region and again in the backup region.

To complete manual deployment, do the following:

• Log into your AWS account

• Go to the CloudFormation console, https://console.aws.amazon.com/cloudformation/

• Click on "Create Stack" > "With new resources (standard)"

Create Stack Button

If this is your first stack, then the option will not have "With new resources"

• In the "Prerequisite - Prepare template" section, select "Upload a template file"

• Upload the CFT YAML file you downloaded earlier

• Click "Next"

• Enter a "Stack name", e.g. "Dropzone-AI"

Stack Name

• In the Parameters section, input the values for the parameters that were defined in the template

• Click "Next"

• On the "Configure stack options" page, click "Next"

• On the "Review and create" page, click "Submit"

Create the stack via the Submit button

• Once the stack creation is complete, click "Resources"

• Record the key ARN value shown

• Once you are done, send both the primary and backup region key ARNs back to Dropzone to be applied to your instance