Hold the key to your Atlassian Cloud data
Atlassian customer-managed keys (CMK) encrypt your new Atlassian Cloud sites with an AWS KMS key from your account. With DuoKey, that key lives in an external key store, so its material never sits in AWS or Atlassian.
Key material outside AWS
The KMS key Atlassian uses is backed by DuoKey through an AWS external key store (XKS).
A kill switch you own
Block the key and Atlassian loses access to the plaintext; restore it and the sites come back.
Every request traced
CloudTrail and the DuoKey journal both record Atlassian's encryption context.
Atlassian asks AWS. AWS asks DuoKey.
Atlassian services call AWS KMS with your key ARN. Because the key lives in an external key store, AWS KMS forwards every operation to the DuoKey XKS proxy, and the key material stays in your DuoKey vault.
- Application-level encryption and server-side encryption for RDS, OpenSearch and EBS through grants.
- Symmetric, single-Region key in the region of your Atlassian realm.
Bound to your tenant.
Atlassian adds an encryption context with your tenant identifier and your own tag to every request. It is authenticated data, visible in CloudTrail and usable in key policy conditions.
- Restrict the key to Atlassian's encryption context and VPC endpoints.
- See the same context in the DuoKey journal.
Revoke, and Atlassian stops.
Disable the key in AWS KMS or block it in DuoKey: Atlassian detects the lost access and suspends the CMK-enabled sites. Enable it again and Atlassian reinstates them.
- Suspension typically within 30 to 60 minutes.
- Restore within 10 days through the Atlassian support ticket.
One key per region of your realm.
Atlassian keeps data and keys co-located in the realm you choose. Dual-region realms in Europe and the United States need one XKS-backed key in each region; Switzerland, Germany and the UK use one.
- Switzerland: eu-central-2. Europe: eu-central-1 and eu-west-1.
- A DuoKey XKS proxy built for high availability in every region.
Key requirements
What Atlassian expects, and how the DuoKey key meets it
| Requirement | Atlassian CMK | DuoKey XKS key |
|---|---|---|
| Key type | Symmetric, encrypt and decrypt | Symmetric key in an external key store |
| Regionality | Single-Region, one key per realm region | Single-Region by design |
| Key policy | Atlassian template (grants, DescribeKey) | Attached when the key is created |
| Rotation | Automatic in Atlassian's CloudFormation template | Manual: move to a new key (no automatic rotation for XKS keys) |
| Revocation | Sites suspended within about an hour | Block in DuoKey or disable in AWS KMS |
Sources: Atlassian CMK documentation and AWS KMS external key store documentation. The full procedure, with the AWS CLI commands and the architecture, is in the DuoKey documentation.
What you set up, and where.
The key policy comes from Atlassian's template; the key itself is created in your external key store with the manual setup, because AWS KMS does not rotate keys in an external key store automatically.
- You pay for key storage; KMS API requests are billed to Atlassian.
- Rotation means moving to a new key through Atlassian's re-encryption process.
Key features
XKS-backed CMK
An AWS KMS key whose material stays in DuoKey.
Atlassian key policy
Atlassian's template attached at key creation.
Encryption context
Tenant identifier and your tag on every request.
Kill switch
Block the key in DuoKey or disable it in AWS KMS.
Dual-region realms
One key per region, same DuoKey control.
Two audit trails
CloudTrail and the DuoKey journal.
Deep dives
Field guides for your programme
FAQ
Atlassian CMK with DuoKey, explained
Customer-managed keys (CMK) let an Atlassian organization admin encrypt the data of new Atlassian Cloud sites with AWS KMS keys held in the organization's own AWS account, instead of Atlassian-managed keys. One CMK encryption policy covers all data in scope for the enrolled sites.
The AWS KMS key you give Atlassian is created in an AWS KMS external key store (XKS) connected to the DuoKey XKS proxy. AWS KMS forwards each operation on that key to DuoKey, and the key material stays in your DuoKey vault, outside AWS and Atlassian.
Atlassian detects the loss of access and suspends the CMK-enabled sites, typically within 30 minutes to one hour, with potential data loss of up to one hour before the revocation. Enable the key again and reply to the Atlassian support ticket: Atlassian can reinstate the sites within 10 days.
Use the manual setup instead. The CloudFormation template enables automatic key rotation, which AWS KMS does not support for keys in an external key store. The DuoKey guide creates the key with the AWS CLI and attaches Atlassian's key policy template.
The regions of Atlassian's CMK realms, including Switzerland (eu-central-2), Germany (eu-central-1), the United Kingdom (eu-west-2) and the dual-region Europe and United States realms, which need one key in each of their two regions.
Atlassian Cloud, with a key AWS never holds.
Set up an XKS-backed customer-managed key for your Atlassian organization with DuoKey.