Skip to content

Set the key lifecycle policy

Decide which operations a key may still perform in each state of its life: for example whether a suspended, revoked or archived key may still decrypt and verify.

Who can do it

A tenant administrator or a tenant key manager, from the tenant's Policies screen. A platform super administrator can edit any tenant's lifecycle policy from Platform Policies.

The lifecycle policy needs no delegation: a tenant may always set its own, as long as it stays within the deployment policy. Without the write permission the grids are read-only, and Reset to DEFAULT appears only with the delete permission.

Before you start

  • Know what the two built-in templates do. DEFAULT keeps data readable after a key is suspended, revoked, archived or rotated: decrypt and verify stay allowed until the material is destroyed. STRICT allows nothing but the active key's current material, so rotating or retiring a key seals what it protected unless the data was re-encrypted first.
  • The deployment lifecycle policy is the ceiling: your tenant may set DENY anywhere, and ALLOW only where the deployment also allows.

Steps

  1. Open Policies and, on the Key Lifecycle card, select Open editor.
  2. Load a starting point, or edit cell by cell:
    • Select DEFAULT or STRICT next to Template to load that template into the grids. Nothing is stored yet.
    • Select a cell in the Alias dimension (Stable KID lifecycle) or the Material dimension (Material Version lifecycle) grid to switch it between ALLOW and DENY. The template then reads CUSTOM. An operation is permitted only when both grids allow it.
  3. Optionally set Default cooling-off before destruction (days): the period used when a destruction request names none, from 7 to 365 days. Leave it empty to inherit the deployment's.
  4. Select Save policy.

To give up your tenant's own policy, select Reset to DEFAULT and confirm with Reset to DEFAULT in Reset lifecycle policy?. Your tenant then follows the deployment lifecycle policy, whatever template the deployment uses.

A platform super administrator opens Platform Policies, selects the tenant's cell in the Lifecycle column of Per-Tenant Policies, and uses the same editor.

What you see when it worked

  • A save shows Lifecycle policy saved, and the template badge names the policy you saved.
  • A reset shows Lifecycle policy reset to deployment DEFAULT, and the grids reload with the policy now in effect.

The crypto service applies the new policy from the next encrypt, decrypt, sign, verify, re-encrypt or re-sign request. There is no restart. The Key Lifecycle card on Policies can show the previous template name for up to a minute.

When quorum approval gates lifecycle policy changes, nothing changes yet: the console shows Waiting for approval with a link to the request.

If it fails

What you see Cause What to do
Cannot save: policy exceeds the deployment ceiling. and a list of cells such as alias · DECRYPT on RETIRED A cell allows what the deployment policy denies Set each listed cell back to DENY, or load a stricter template
Cannot save: the deployment lifecycle ceiling is missing. The deployment has no stored lifecycle policy Report it to the platform administrator: an installation always has one
Save policy stays disabled Nothing changed, or the cooling-off value is outside 7 to 365 days Change a cell, or correct the value
You do not have permission to view the lifecycle policy. You lack the permission to read the lifecycle policy Ask for a role that holds it
Could not load the DEFAULT/STRICT templates. The templates could not be read Edit the cells by hand, or reload later

Without the console

Surface How
Key management CLI No command
Admin SDK Not available
API PUT /api/v3/admin/tenants/{tenantId}/policies/lifecycle with the whole policy (operation replaceTenantLifecyclePolicy); DELETE /api/v3/admin/tenants/{tenantId}/policies/lifecycle to follow the deployment policy (operation resetTenantLifecyclePolicy)