@Rocky does StarRocks support Transparent Data Encryption with external key management integration?

StarRocks supports Transparent Data Encryption (TDE) at the storage level, though integration with external Key Management Systems (KMS) is a relatively new and evolving feature. 1. TDE Support (v3.3.1+) Transparent Data Encryption was introduced in v3.3.1 (and further refined in v3.4.0). When enabled, StarRocks automatically encrypts data files (segment files, rowsets, lake SSTs, etc.) at rest on the local disk or object storage. * Activation: It is enabled via the Backend (BE) and Compute Node (CN) configuration parameter:

properties
    enable_transparent_data_encryption = true

* Mechanism: The system uses an internal Key Manager in the Frontend (FE) to manage encryption keys. It follows an envelope encryption model where Data Encryption Keys (DEK) are used to encrypt the actual data, and these DEKs are wrapped by Key Encryption Keys (KEK) or Master Keys. 2. External KMS Integration While the core TDE infrastructure exists in the open-source version, integration with external KMS providers (like AWS KMS, Azure Key Vault, or HashiCorp Vault) is not yet fully documented as a standard open-source feature. * Internal Key Management: By default, StarRocks manages the master keys internally within its metadata. * Enterprise/Cloud Availability: Advanced integration with cloud-native KMS (such as AWS KMS for TDE master keys) is primarily featured in CelerData Enterprise and CelerData Cloud (the commercial offerings based on StarRocks). * External Catalogs: For Data Lakes (Iceberg, Hive, etc.), StarRocks can leverage the underlying storage encryption (e.g., S3 Server-Side Encryption with KMS) through catalog properties, but this is handled by the storage provider rather than StarRocks' internal TDE. Recommendation If you require external KMS integration for native StarRocks tables (OLAP tables): 1. Check Version: Ensure you are on v3.4.0 or later, as the "Key Manager in FE" was a primary focus for that release. 2. Verify Enterprise Requirements: If the standard

enable_transparent_data_encryption

does not provide the KMS hooks you need, this specific integration may require the Enterprise version. 3. Community Inquiry: Because the documentation for this specific area is limited, it is highly recommended to reach out on the StarRocks Slack or check the latest GitHub Discussions for the specific configuration properties required to hook into an external KMS provider. References • sql-reference/sql-functions/crytographic-functions/aes_encrypt.md • administration/management/BE_configuration.md • administration/management/monitoring/metrics.md • sql-reference/sql-functions/crytographic-functions/aes_decrypt.md • sql-reference/sql-functions/crytographic-functions/sm3.md • administration/management/resource_management/Blacklist.md