Ctrlk
TessellAPIsLabsFAQsBlogsVideos
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Security

The Security app, part of the Governance app family, allows you to manage encryption keys and password policies for your Tessell environment. Encryption keys protect data at rest for your database services. Password policies are organization-level settings, typically managed by account administrators to define the minimum password strength and password expiry period for all users. Users are required to reset their passwords when they expire.

The Security app has two tabs:

  • Encryption Keys — Create and register encryption keys across cloud subscriptions and regions.

  • Password Policies — Configure password restrictions and expiry rules for users.

Key concepts

Encryption keys

Tessell encrypts all database data at rest using encryption keys. You can use one of two key types:

  • Tessell Managed — Tessell creates and manages the encryption key on your behalf within your registered cloud subscription. This is the default option and requires no additional configuration on your cloud account.

    Note: This is only applicable to Tessell Managed or Virtual Private Tessell (VPT) subscriptions.

  • Customer Managed (BYOK) — You bring your own encryption key from your cloud account (AWS KMS or Azure Key Vault) and register it with Tessell. This gives you full control over the key lifecycle, including rotation and deletion policies.

Encryption keys are scoped to a cloud subscription and made available across one or more regions within that subscription. When you provision a database service, you select an encryption key from the keys available in the subscription and region you are deploying to.

Password policies

Password policies apply organization-wide to all Tessell portal users. They define the minimum requirements for password complexity, password expiry period, and control how many failed login attempts are allowed before a user is locked out.

Prerequisites

Before you create or register an encryption key, ensure the following:

  • You have registered a cloud subscription in the Subscriptions app under the Governance app family.

  • For customer-managed keys on AWS: the KMS key must exist in your AWS account, must be of type Symmetric with key usage set to Encrypt & Decrypt, and must have the ALLOW_IMPORT_TO_TESSELL: true tag applied. The key must also have cross-region replication enabled.

  • For customer-managed keys on Azure: the key must exist in the Key Vault registered with your Tessell subscription.

Security dashboard

To access the Security app, select Security under the Governance app family in the left navigation bar. Security app is accessible only to account owners and users whose personas grant them access to this app.

The dashboard has two tabs: Encryption Keys and Password Policies.

Encryption keys

The Encryption Keys tab lists all encryption keys registered with Tessell across your subscriptions.

Filters

You can filter the encryption keys list using the following fields:

  • Search — Specify a key name to search for a specific encryption key. The list filters automatically as you type.

  • Maturity — Select a maturity status from the dropdown list. Available options are All, Draft, Published, or Unpublished.

  • Owner — Select a username to view keys owned by a specific user.

  • Subscriptions — Select a subscription to view keys associated with a specific subscription.

  • Clear — Select this to clear all selected filters and return to the default view.

Encryption keys table

The encryption keys table displays the following columns:

  • Name — The name of the encryption key registered with Tessell.

  • Cloud — The cloud provider the key is associated with.

  • Regions — The number of regions in which the key is available. Select the number to view the list of regions.

  • Maturity — The maturity status of the key: Draft, Published, or Unpublished.

  • Status — The current status of the key: Available or Unavailable.

  • Owner — The owner of the encryption key.

  • Key Type — Whether the key is Tessell Managed or Customer Managed.

  • Ellipsis icon — Select the ellipsis icon to access the following options:

    • Add Co-owners — Share the encryption key with other users by granting them the co-owner role.\

      Note: Adding co-owner role grants other users permission to manage the key's lifecycle within Tessell, including deleting the key, updating its maturity status, and so on.

    • Remove Co-owners — Remove co-owner access from a user.

Fig 1: Security dashboard

Create an encryption key

Use this option to create an encryption key. Tessell creates and manages the key on your behalf in the selected cloud subscription.

Create a Tessell Managed key

Creating a Tessell-managed key is only supported for VPT subscriptions or subscriptions where the customer has granted Tessell the necessary permissions to create and manage the key.

  1. Select + Create in the top-right corner of the Encryption Keys tab. The Create Key page opens.

  2. From the Tessell Subscription dropdown list, select the subscription.

  3. In the Name field, specify a name for the encryption key.

  4. Optionally, add a description in the Description field.

  5. In the Cloud dropdown list, cloud provider is displayed based on the subscription selected.

  6. The Use Tessell generated secret key check box is selected by default. Keep this selected to allow Tessell to generate and manage the key material.

  7. Select Create.

Fig 2: Create key – AWS / Azure

Import a customer-managed key on Azure

Step 1: Select region

  1. Select + Create in the top-right corner of the Encryption Keys tab. The Create Key page opens.

  2. From the Tessell Subscription dropdown list, select the Azure subscription.

  3. In the Azure Region section, select the region from the Select Region dropdown list.

    Note: The following steps let you define the configuration for your encryption key. The resources are deployed using an ARM template.

    If you have already executed the ARM template, select Paste ARM output to skip to the last step and provide the ARM deployment output (JSON) directly.

  4. Select Next.

Fig 3: Create key – Azure region selection

Step 2: Configure encryption key

  1. In the Encryption Key section, provide the following details:

    • Key Vault Name — Specify the name of the new Key Vault. This Key Vault is created in the resource group you select when deploying the ARM template.

    • Key Name — Specify the name of the encryption key.

    • Disk Encryption Set Name — Specify the name of the Disk Encryption Set associated with the encryption key.

    Note: This is the default key Tessell uses in this region. You can register more keys later.

  2. Select Next.

Fig 4: Create key – Azure encryption key configuration

Step 3: Launch ARM template

  1. In the Launch ARM Template section, review the resources that will be created:

    • Encryption key in the specified Key Vault

    • Disk Encryption Set for the encryption key

  2. Note the resource group displayed — you must select this same resource group when launching the ARM template in Azure.

  3. Select Launch ARM Template to open the ARM template in Azure, or select Copy URL to copy a direct link to the template.

  4. Select Next.

Fig 5: Create key – Azure ARM template launch

Step 4: Provide ARM deployment output

  1. After the ARM template executes successfully, copy the JSON output.

  2. In the ARM Deployment Output section, paste the JSON output in the ARM Deployment Output (JSON) field.

  3. Select Create.

Fig 6: Create key – Azure ARM deployment output

Register an encryption key

Use this option to register a customer-managed encryption key (BYOK) from your own AWS account. Registration is available for AWS only.

The AWS registration flow supports two modes:

  • Key from a registered AWS account — The AWS account is already registered as a Tessell subscription. Tessell can discover and list available keys in the account.

  • Key from an external AWS account — The AWS account is not registered with Tessell. You provide the Key ARN manually.

To register a key:

  1. Select Register in the top-right corner of the Encryption Keys tab. The Add New Key page opens.

  2. In the Subscription Details section:

    1. To register a key from an AWS account not registered with Tessell, select the Register Key from other AWS account (Account not registered with Tessell) check box.

    2. From the Tessell Subscription dropdown list, select the subscription.

    3. In the Cloud dropdown list, cloud provider is displayed based on the subscription selected.

  3. In the Select Key to Register section:

    Note: Tessell does not recommend rotating registered keys, as it may lead to unexpected consequences.

    1. From the Region dropdown list, select the region where the key is located.

    If the account is registered with Tessell:

    • The Available encryption keys list displays keys discovered in your account for the selected region. Select the key you want to register.

    • If keys cannot be listed, ensure that kms:ListKeys or kms:ListAliases permissions are granted to Tessell.

    If the account is not registered with Tessell:

    • In the Key ARN field, specify the ARN of the KMS key.

    • Select Run Permissions Checks to verify that the required permissions are in place before registering.

  4. In the Basic Information section, specify a name for the key in the Name field.

  5. Select Register.

Required permissions

For Tessell to use an AWS KMS key, the following must be configured on the key in your AWS account:

Key policy — Add the following policy to the KMS key:

Tag — Add the following tag to the KMS key:

Tag key
Tag value

ALLOW_IMPORT_TO_TESSELL

true

Additional requirements for multi-region keys:

  • The primary key instance must be registered first.

  • If replica keys are present and the required permissions are granted, Tessell registers replica key instances on demand.

Fig 7: Register key – AWS (external account)

Fig 8: Register key – AWS (registered account)

Password policies

The Password Policies tab displays the password restrictions and expiry rules configured for your organization. These policies apply to all Tessell portal users.

The following settings are displayed:

  • Expires after (days) — The number of days after which a user's password expires and must be changed.

  • Maximum invalid attempts — The number of consecutive failed login attempts allowed before a user is locked out.

  • Minimum length (characters) — The minimum number of characters required for a password.

  • Upper case — Whether at least one upper case character is required.

  • Lower case — Whether at least one lower case character is required.

  • Special characters — Whether at least one special character is required. Supported special characters: " ! # $ % & ' ( ) * + , - . / \ : ; < = > ? @ [ ] ^ _ { | } ~`

  • Numeric characters — Whether at least one numeric character is required (0–9).

Fig 9: Password Policies tab

Edit password policies

  1. Select Edit in the top-right corner of the Password Policies tab. The Edit Password Policies dialog box opens.

  2. Update the following fields as needed:

    • Expires after (days) — Specify the number of days before a password expires.

    • Maximum invalid attempts — Specify the maximum number of consecutive failed login attempts before lockout.

    • Minimum length (characters) — Specify the minimum password length.

    • Upper case — Select the check box to require at least one upper case character.

    • Lower case — Select the check box to require at least one lower case character.

    • Special characters — Select the check box to require at least one special character.

    • Numeric characters — Select the check box to require at least one numeric character.

  3. Select Save.

Fig 10: Edit Password Policies

PreviousIAMNextDB Governance

Last updated

Was this helpful?