Audit Log Encryption Keys
On this page
An encryption key lets Ververica Cloud protect the request and response content inside your audit events. Without a key, audit logs still capture full event metadata (who did what, when, and whether it succeeded); only the request and response content is left out.
How the encryption works
Ververica Cloud uses hybrid encryption to protect request and response content:
- Each
requestBodyorstatefield is encrypted individually with a fresh AES-256-GCM key and a 12-byte nonce, not the log line as a whole. - That AES key is then wrapped with your RSA-4096 public key, using OAEP with SHA-256.
- The stored value is the wrapped AES key (512 bytes), the nonce (12 bytes), and the AES-GCM ciphertext, concatenated and base64-encoded.
Only your private key can unwrap the AES key and decrypt the content. Ververica Cloud never receives or stores your private key, so keep it somewhere you control. Neither the underlying log file nor object storage ever holds this content unencrypted.
Generate a key pair
Generate a 4096-bit RSA key pair, for example with OpenSSL:
1# Generate the private key (4096-bit RSA, PEM format)
2openssl genrsa -out private_key.pem 4096
3
4# Derive the public key from the private key
5openssl rsa -in private_key.pem -pubout -out public_key.pemKeep private_key.pem somewhere secure. You need it to decrypt the request and response content in your audit logs, and Ververica Cloud has no copy of it: if you lose it, that content can't be recovered (event metadata remains available either way).
Add your public key
Open Audit Logs (in the organization admin panel for an organization, or in your profile menu for a personal account) and turn audit logging on. If no key is configured yet, this opens a dialog asking for your public key.
- Paste the contents of public_key.pem, including the
BEGIN PUBLIC KEY/END PUBLIC KEYlines. - The key must be a PEM-encoded RSA-4096 public key; a different size or format is rejected with an error.
- Paste only the public key. If you paste a private key by mistake, it's rejected immediately, before anything is sent, precisely because a private key must never leave your environment. Rotate the key pair if that happens, since the private key should be treated as exposed.
Once saved, the key is shown in a read-only field so you can confirm it's the one you intended.
Replace your key
To replace an existing key, turn audit logging off first, then use the replace option and paste the new public key.
Replacing your key doesn't affect logs already encrypted with the previous key. You still need the original private key to decrypt those; keep old private keys until you no longer need the audit logs encrypted with them.
Turning audit logging off and on
Turning audit logging off keeps your configured key on file, so turning it back on later doesn't ask for the key again. It only stops new events from being recorded; events already collected stay available for the rest of the retention window.