Use Multiple Encryption Rules

Client-Side Field Level Encryption (CSFLE) allows you to safeguard sensitive data, such as personally identifiable information (PII), by enabling field-level encryption at the producer and consumer levels.

Each CSFLE encryption rule is uniquely defined by the combination of the schema subject, the assigned tags, and the Key Encryption Key (KEK). This enables you to apply different encryption rules to different fields within the same schema by using distinct tags. For more about how to assign tags to fields, see Configure client-side field level encryption.

Important

CSFLE support for multiple encryption rules per schema is a Limited Availability feature in Confluent Cloud. If you would like to participate in the Limited Availability Program, contact your Confluent account team. to participate in the Limited Availability Program, contact your Confluent account team.

Multiple rule considerations

Before using multiple encryption rules for a schema, review the following important considerations:

  • API/CLI/Terraform only: Support for multiple encryption rules per schema is available only through the REST API, Confluent CLI, and Terraform. There is no Cloud Console support.

  • Cost implications: You will be charged for each rule as an extra cost. For example, if you use 3 encryption rules per schema, you will be charged for three rules. To help control costs, do not use this capability in an uncontrolled manner.

  • Performance testing: Run performance and scale testing to understand the implications of using multiple rules.

  • Avoid overlapping rules: Fields with two or more overlapping rules are encrypted based on all applicable rules, which could result in unexpected behavior. For example, if a field is tagged with both PII and PHI and you have defined an encryption rule for both tags, that field is encrypted twice. The consumer must have access to both KEKs to be able to decrypt the data. When you add new tags or new rules to an existing schema to make sure to avoid unintentionally creating overlapping rules.

  • Client versions: Use the latest version of a client when implementing this feature.

Prerequisites

To use CSFLE with multiple encryption rules, you must have the following prerequisites:

To learn more, see Requirements.

Enable Multiple Encryption Rules Support

To enable support form multiple encryption rules, send a PUT request to the schema registry endpoint with a request body that sets validateRules to false. This setting enables multiple encryption rules for the schema.

curl -X PUT "SCHEMA_REGISTRY_ENDPOINT/config" \
  -H "Content-Type: application/json" \
  -d '{
    "validateRules": false
  }'

After this call, you can create multiple encryption rules for the same schema by using the same schema subject and different tags and KEKs. To learn more about using multiple rules, see Rule ordering and its impact on DLQ.

Related content