Learn about security solutions and standards
Care about security? We do too. Learn what Atlassian does and what you can do too.
Revoke access to your BYOK encryption keys
BYOK encryption for Jira Software and Confluence is available to all customers with Enterprise plans.
BYOK encryption for Jira Service Management is available through an early access program (EAP) to a number of customers with Enterprise plans. If you're interested in participating in the EAP, reach out to your Enterprise account representative.
You can revoke access to your BYOK encryption keys at any point. The revocation suspends all BYOK-enabled products both for your end users and for Atlassian systems. This means that the products are offline until access to the BYOK keys is restored.
To revoke access to your BYOK encryption keys:
Log in to your AWS console. If you need help with your AWS account, contact AWS support.
Make sure that your Amazon account region is set to one of the two regions in the location chosen for the BYOK encryption. Read about the locations and regions after the final step.
Go to the IAM console.
Search for atlassian-key-management on the left side of the dashboard.
Go to Trust relationships.
In the Trusted entities section, select Edit trust policy.
Change the Cryptor-OSB-Provider statement from Allow to Deny:
1 2 3 4 5 6 7{ "Effect": "Deny", "Principal": { "AWS": "arn:aws:iam::279766244153:role/Cryptor-OSB-Provider" }, "Action": "sts:AssumeRole" }Select Update policy.
Go to the KMS console and make sure to select the correct region.
Select the checkboxes next to all the KMS keys prefixed with cryptor.
Select the Key actions drop-down list at the top right corner.
Select Disable.
In the pop-up message that appears, check the confirmation box and select Disable key to disable the KMS keys.
When admins set up BYOK encryption, they choose a location, either European Union or USA. Both locations have two regions:
European Union consists of eu-central-1 (Frankfurt) and eu-west-1 (Dublin) regions
USA consists of us-east-1 (N. Virginia) and us-west-2 (Oregon) regions.
You need to disable keys in both regions, so repeat this process until you've disabled all keys that are prefixed with cryptor in both regions within your location.
It can take up to an hour before the process to revoke access to your keys starts.
What’s next?
We'll create a support ticket titled BYOK revocation started for AWS account, and reach out to you within a couple of days.
Restoring access after revocation
Access to your encryption keys can be restored within three days of revocation. Learn how to restore access to BYOK encryption keys
Was this helpful?