# \[RELEASE\] ScyllaDB Cloud Terraform Provider version 1.13 (Encryption Support)

**URL:** <https://forum.scylladb.com/t/release-scylladb-cloud-terraform-provider-version-1-13-encryption-support/5462>\
**Category:** Release Notes\
**Tags:** cloud, cloud-release, terraform\
**Created:** [August 13, 2026, 11:54am UTC](https://forum.scylladb.com/t/release-scylladb-cloud-terraform-provider-version-1-13-encryption-support/5462 "2026-08-13T11:54:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Buff](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.scylladb.com/buff/32/1948_2.png) [@Buff](https://forum.scylladb.com/u/Buff)\
**Post date:** [August 13, 2026, 11:54am UTC](https://forum.scylladb.com/t/release-scylladb-cloud-terraform-provider-version-1-13-encryption-support/5462/1 "2026-08-13T11:54:45Z")

</div>

![ScyllaDB](https://us1.discourse-cdn.com/flex016/uploads/scylladb/original/2X/1/17b4911a4f5dfff075e6bfef7250fc0ba11cfe06.png)

Hello,

The ScyllaDB team is pleased to announce the new version 1.13.0 of the ScyllaDB Cloud Terraform provider.

## Highlights

### Encryption at Rest (Database-level)

All new clusters are created with database-level encryption at rest enabled using a ScyllaDB-managed key, matching the default behavior of the ScyllaDB Cloud portal. No further configuration is required.

There is an option to use a customer-managed key instead of a ScyllaDB managed key.  
To do so, create the customer-managed key in the ScyllaDB Cloud portal first and pass its ID as follows:

```auto
encryption_at_rest {
  key_id = "key-deadbeef"
}

```

For improved security and compliance, use a dedicated customer-managed key for each cluster.

> **Note:** Encryption at rest can only be configured when a cluster is created. Changing any field in this block replaces the cluster. Clusters created before this default was introduced are unaffected: omitting the block preserves the cluster’s existing configuration and never plans a replacement.

For more information, see [Database-Level Encryption](https://cloud.docs.scylladb.com/stable/security/database-level-encryption.html).

### Encryption in Transit

All new clusters support TLS 1.3-encrypted client-to-node connections. Clients can validate the server certificates using the cluster’s CA certificate, exposed through the following attribute:

`ca_certificate` (String) — The PEM-encoded CA certificate used to validate TLS-encrypted client-to-node connections to the cluster. Empty when encryption in transit is not enabled.

For connection instructions, see [Client-to-node Encryption](https://cloud.docs.scylladb.com/stable/security/client-to-node-encryption.html).

Terraform Provider: [Terraform Registry](https://registry.terraform.io/providers/scylladb/scylladbcloud/1.13.0/docs)