Skip to main content
Documentatie
Documentatie
Adaptive Planning
Laatst bijgewerkt: 2025-03-14
Set Up Adaptive Planning Bring Your Own Key (BYOK)

Set Up Adaptive Planning Bring Your Own Key (BYOK)

  • Acquire the BYOK SKU and agree to the applicable terms.
  • Set up and configure the Amazon Web Services (AWS) Key Management Service (KMS).
  • Your Named Support Contact (NSC) must open a support case in the Workday Community with the Amazon Resource Name (ARN) to Adaptive Planning:
    arn:aws:iam::123456789123: user/workday-kms-user
     to enable the feature.
Adaptive Planning BYOK is an encryption key management capability that enables enterprises to take ownership and control of the keys they use for data encryption. The Bring Your Own Key Customer Key Encryption Key (BCKEK) is a root key that you generate and store in your AWS KMS. The BCKEK replaces the Customer Key Encryption Key (CKEK) in the key hierarchy and is used to encrypt and decrypt the Data Encryption Key (DEK).
After you deploy Adaptive Planning BYOK, you can’t revert it and go back to using Adaptive Planning-issued encryption keys.
You must create a primary key for Adaptive Planning to use as the BCKEK.
  1. In your AWS account, create a primary symmetric key.
  2. Edit the key policy to assign proper permissions to the Adaptive Planning production account ID as shown: 
    "Sid": "Allow use of the key",
         "Effect": "Allow",
         "Principal": {
             "AWS": [
                 "arn:aws:iam::244702149041:root"
             ]
         },
         "Action": [
             "kms:Encrypt",
             "kms:Decrypt",
             "kms:ReEncrypt*",
             "kms:GenerateDataKey*",
             "kms:List*",
             "kms:Get*",
             "kms:CreateGrant",
             "kms:ListGrants",
             "kms:RevokeGrant",
             "kms:DescribeKey"
         ],
         "Resource": "*"
     },
     {
         "Sid": "Allow attachment of persistent resources",
         "Effect": "Allow",
         "Principal": {
             "AWS": [
                 "arn:aws:iam::244702149041:root"
             ]
         },
         "Action": [
             "kms:CreateGrant",
             "kms:ListGrants",
             "kms:RevokeGrant"
         ],
         "Resource": "*",
         "Condition": {
             "Bool": {
                 "kms:GrantIsForAWSResource": "true"
             }
         }
     }
  3. After your database is provisioned on the agreed upon date, confirm that the new key is working without any issues.
If you wish to rotate your keys, you can do so inside AWS KMS.
To remove access to your keys from Adaptive Planning, either:
  • Disable the keys inside AWS KMS.
  • Keep the keys enabled and remove Adaptive Planning permissions inside the key policy.
Never delete your BCKEK:
  • If you delete the BCKEK that's actively in use, Adaptive Planning won’t be able to recover the data in your database.
  • If you delete an old BCKEK, any backups that you created while that BCKEK was actively in use won't be recoverable.
For maximum safety, Adaptive Planning recommends that you don’t delete old BCKEKs. Keep these old keys in the disabled state, which prevents their use but enables you to reactivate them in case of emergency.