manage_dfc_keys
Manage DFC encryption keys: create, update, delete, list, enable/disable, and rotate, with auto-rotation and certificate generation.
Instructions
DFC KEY MANAGEMENT TOOL - Advanced encryption key management and lifecycle
SUPPORTED ACTIONS: • create: Create new DFC keys with encryption algorithms (AES128GCM, AES256GCM, RSA2048, etc.) • update: Modify DFC key properties, tags, and metadata • delete: Delete DFC keys with proper cleanup • list: List DFC keys in directory with filtering • set_state: Enable/disable DFC keys for access control • rotate: Rotate DFC keys on demand with new certificates and key data
ADVANCED FEATURES: • Auto-rotation with configurable intervals (7-365 days) • Customer fragment encryption for enhanced security • Self-signed certificate generation with X.509 support • Split levels (3 or 4 fragments) for key distribution • Expiration and rotation event notifications • Comprehensive metadata and configuration support
SECURITY CAPABILITIES: • Enterprise-grade key management with audit trails • Access control and delete protection • Customer fragment integration • Certificate lifecycle management • Compliance and governance reporting
Example: Create an AES256GCM DFC key with auto-rotation for application encryption
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| json | No | Set output format to JSON | |
| name | No | DFC key name/path (required for create, update, delete, set_state) | |
| path | No | Path to list keys from (for list action) | |
| tags | No | List of tags attached to this DFC key | |
| action | Yes | DFC key management action to perform. SUPPORTED ACTIONS: 'create' (create new DFC keys with encryption algorithms), 'update' (modify DFC key properties), 'delete' (delete DFC keys), 'list' (list DFC keys in directory), 'set_state' (enable/disable DFC keys), 'rotate' (rotate DFC keys on demand) | |
| rm_tags | No | Tags to remove (for update) | |
| version | No | Version to delete (-1 for all versions) | |
| add_tags | No | Tags to add (for update) | |
| key_type | No | 🔐 ENCRYPTION KEY MANAGEMENT: Encryption algorithm (AES128GCM, AES256GCM, RSA2048, etc.) - choose based on your security requirements | AES256GCM |
| metadata | No | Additional metadata in JSON format | |
| new_name | No | New name for the key (for update) | |
| filter_by | No | Filter keys by pattern (for list action) | |
| auto_rotate | No | Enable auto-rotation (None = use API default, 'true'/'false') | |
| description | No | Human-readable description of the key | |
| split_level | No | Number of fragments (3 or 4) | |
| max_versions | No | Maximum number of versions (for update) | |
| new_key_data | No | New base64 encoded value for classic keys (bring-your-own-key) | |
| accessibility | No | Accessibility level | regular |
| desired_state | No | Desired state: 'Enabled' or 'Disabled' (capitalized, for set_state) | |
| conf_file_data | No | Configuration file data | |
| delete_in_days | No | Soft delete retention period in days | |
| protection_key | No | Customer fragment ID (full UUID or partial - system automatically searches for full match) | |
| certificate_ttl | No | Certificate TTL in days (1-365) | |
| delete_protection | No | Protection from accidental deletion | |
| new_cert_pem_data | No | New PEM encoded certificate for classic keys (bring-your-own-key) | |
| rotation_event_in | No | Days before rotation to notify | |
| rotation_interval | No | Days between rotations (7-365, only used if auto_rotate is 'true') | |
| certificate_format | No | Certificate format (PEM, DER, etc.) | |
| delete_immediately | No | Delete immediately (bypass soft delete) | |
| certificate_country | No | Certificate country code | |
| expiration_event_in | No | Days before expiration to notify | |
| certificate_locality | No | Certificate locality/city | |
| certificate_province | No | Certificate province/state | |
| certificate_common_name | No | Certificate common name | |
| certificate_digest_algo | No | Certificate digest algorithm (for RSA keys, only 'sha256' is supported) | |
| certificate_organization | No | Certificate organization | |
| generate_self_signed_certificate | No | Whether to generate a self signed certificate with the key. If set, certificate_ttl must be provided. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||