Hello,
The ScyllaDB team is pleased to announce the new version 1.13.0 of the ScyllaDB Cloud Terraform provider.
Highlights
Encryption at Rest (Database-level)
All new clusters are created with database-level encryption at rest enabled using a ScyllaDB-managed key, matching the default behavior of the ScyllaDB Cloud portal. No further configuration is required.
There is an option to use a customer-managed key instead of a ScyllaDB managed key.
To do so, create the customer-managed key in the ScyllaDB Cloud portal first and pass its ID as follows:
encryption_at_rest {
key_id = "key-deadbeef"
}
For improved security and compliance, use a dedicated customer-managed key for each cluster.
Note: Encryption at rest can only be configured when a cluster is created. Changing any field in this block replaces the cluster. Clusters created before this default was introduced are unaffected: omitting the block preserves the cluster’s existing configuration and never plans a replacement.
For more information, see Database-Level Encryption.
Encryption in Transit
All new clusters support TLS 1.3-encrypted client-to-node connections. Clients can validate the server certificates using the cluster’s CA certificate, exposed through the following attribute:
ca_certificate (String) — The PEM-encoded CA certificate used to validate TLS-encrypted client-to-node connections to the cluster. Empty when encryption in transit is not enabled.
For connection instructions, see Client-to-node Encryption.
Terraform Provider: Terraform Registry