Encrypting Credentials

Prerequisites

Before you encrypt your credentials, make sure you take the following steps:

• Update to the latest version of the agent.
• Store a secure copy of the cleartext credentials or the cleartext credentials file to allow easy updates in the future. The encryption process overwrites the existing cleartext version of the credentials file with an encrypted version.

Enable Credential Encryption

Credentials are stored in the event-streaming-configuration.properties file. These credentials contain the tenant client secret key or JWT token. By default, the credentials are stored as cleartext and are not encrypted when the agent starts.

To encrypt the credentials on your system, configure the following properties in the agent-runtime.properties file before you restart the agent:

• encryptCredentialsOnStartup=true
• event.streaming.tenantID to your tenant ID

When the agent restarts and detects that encryptCredentialsOnStartup is true and the credentials file is cleartext, the agent generates an encryption key to encrypt the credentials file. On subsequent restarts of the agent, the agent uses the encryption key to read the encrypted credentials file.

Configure the Encryption Key

Optionally, you can provide your own custom encryption key that is exactly 32-bytes in size and stored in a file that is accessible by the agent.

Add the encryptionKeyFilePath property to the agent-runtime.properties file to specify the full path of the file that contains your key. For example, add encryptionKeyFilePath=/opt/sas/key_store/my_agent_key.txt that points to a file that contains an example key of o6SejG4jBa0ClZUGxxLbpY4JKEija1ap.

When the agent starts and detects that encryptCredentialsOnStartup is set to true, the encryptionKeyFilePath is specified, and the credentials file is cleartext, the agent encrypts the credentials using the key that is specified in encryptionKeyFilePath.

Follow these steps to replace the encryption key:

1. Shut down the agent.
2. Replace the credentials file in event-streaming-configuration.properties with the cleartext version.
   Note: You must replace the credentials with a cleartext version. Otherwise, the agent attempts to use a different key to encrypt or decrypt the credentials. The process fails and the agent cannot start.
3. Update encryptionKeyFilePath in agent-runtime.properties to specify the full path of the file that contains the new encryption key.
4. Restart the agent so that it can encrypt the credentials with the new key.