Problem Description
Scheduled backups for Cloud Apps fail to trigger. While manual backups function correctly, the automated scheduling process does not initiate.
Cause
This issue occurs because the Druva inSync environment lacks access to the required data encryption key (ekey).
To ensure the security and integrity of your data, inSync uses a digital envelope encryption process. Because Druva does not store user-specific ekeys, the system must have a mechanism to dynamically derive or access the ekey at the time of the scheduled backup. Without a configured key management method, the system cannot secure the data stream, causing the scheduled task to remain untriggered.
Resolution
To enable scheduled backups, you must configure a key management solution. Choose one of the following methods:
Option 1: Enable Cloud Key Management (Recommended)
The Cloud Key Management feature utilizes AWS Key Management Service (AWS KMS) to handle encryption securely. When enabled, the system generates a Data Key to encrypt the ekey; this encrypted ekey is stored within the inSync Cloud. During a scheduled backup, the system uses the Data Key and the encrypted ekey to derive the necessary encryption key, allowing the backup to proceed.
Steps to configure:
Log in to your inSync console as a Cloud administrator.
Navigate to Endpoints & SaaS Apps Settings.
Select the Cloud Key Management tab and click Edit.
4. Select the Enable Cloud Key Management feature checkbox.
5. Click Save.
For detailed configuration steps and prerequisites, see How to Activate Cloud KMS in SaaS Apps Management Console.
Option 2: Enable Bring Your Own Key (BYOK) / Enterprise Key Management
If your organizational security policy requires you to maintain exclusive control over the encryption keys used for your data, use Enterprise Key Management (also known as BYOK). This allows you to use keys from your own AWS KMS account to manage the encryption and decryption processes.
Note: For detailed configuration steps and prerequisites, see Enterprise Key Management (BYOK)
📝 Important Considerations
Irreversibility: Once the Cloud Key Management feature is enabled for your inSync instance, it cannot be disabled.
Security Policy: Before enabling these features, please review these settings with your Network Security Team to ensure compliance with your company's internal security policies regarding the use of AWS KMS.