anchor.diff:          properties:
             database_encryption: &encryption_info
               keys:
  -              encryption_key: "example-random-key-string"
  -            current_key_label: "encryption_key"
  +              <%= encryption_key %>: "example-random-key-string"
  +            current_key_label: "<%= encryption_key %>"
     ...
     cc-worker:
       jobs:
  
positive.code: ---
  
  <strong><%= modified_date %></strong>
  
  This topic describes how operators can encrypt sensitive data in the Cloud Controller (CC) database using operator-provided keys.
  
  
negative.code: 
  1. Choose a value for the encryption key (e.g. `"example-random-key-string"`).
  
  1. Choose a label for the encryption key (e.g. `<%= encryption_key %>`). The label must abide by the following restrictions:
    * 127 character limit
    * Cannot contain a `:` (colon)
  
  1. Format the encryption key values into YAML as follows:
  
      ```
      current_key_label: "<%= encryption_key %>"
      keys:
        <%= encryption_key %>: "example-random-key-string"
      ```
  
      <p class='note'><strong>Note</strong>: If your CC instance groups have the <code>db_encryption_key</code> key, make sure that the
      <code>db_encryption_key</code> is added into the <code>keys</code> block, and that its corresponding key label is set to be the <code>current_key_label</code>.
      For example:</p>
  
      ```
      db_encryption_key: "example-random-key-string"
      current_key_label: "<%= encryption_key %>"
      keys:
        <%= encryption_key %>: "example-random-key-string"
      ```
  
  1. Make the changes by either creating and applying an [ops file](#configuring-via-ops-file) or directly modifying the [manifest](#configuring-via-manifest).
  
  1. Deploy the changes with the following command.
  
      <pre class='terminal'>
      # With an ops file
      $ bosh deploy -o YOUR_OPS_FILE_NAME PATH_TO_YOUR_MANIFEST
  
      # Directly modifying the manifest
      $ bosh deploy PATH_TO_YOUR_MANIFEST
      </pre>
  
  1. Run the bosh errand to encrypt the fields.
  
  