Why it matters
Customer-managed keys change who can authorize encryption and decryption. They also introduce key availability, rotation and recovery into the customer experience.
The key must have a clear scope: one tenant, environment or data class. A revoked or inaccessible key can make data unavailable even when storage is healthy.
Decisions to make
- Choose whether keys live in your cloud account, a customer account or an external store.
- Define the data classes and services covered by each key.
- Set rotation, disablement and deletion behavior with the customer.
- Decide how to prove which key protected a given object.
- Plan customer offboarding without losing required retained data.
Build checklist
- Bind each tenant to an explicit key reference and validate permissions.
- Test key outage, revocation, rotation and region mismatch.
- Avoid storing plaintext copies outside the promised encryption boundary.
- Audit key changes and decryption failures without logging secrets.
- Provide a recovery runbook for an inaccessible customer key.
Common mistakes
- Calling a provider-managed default key BYOK.
- Allowing shared search indexes or backups to bypass the customer key policy.
- Deleting a key before all dependent data has been migrated or expired.
Tools & references
3 starting points to compare or study. Check fit, maintenance, terms and current capabilities before choosing one.