Lost or rotated master key

This runbook helps you when start-up fails with DBX029: the master key cannot unwrap a tenant key.

Deedbox stops instead of reading personal data as erased. Nothing is lost yet.

Steps

1. Read the message. It names the tenant, the key version, and the master key version that wrapped it (for example env:v1).
2. If you rotated the key ring and removed the old version too early, add the old version back to the ring after the new one: v2:<new>,v1:<old>. Deploy. Then run deedbox keys rewrap and remove the old version again. See rotate keys.
3. If the app runs with the wrong key mode, for example FromEnvironment against a database still in database mode, configure the mode that wrapped the keys.
4. If the key is truly lost, the personal data under it is lost. The events and all other data remain. Recover the key from your secret store’s backup if you have one.

Prevent it

• Keep the master key in a secret store with its own backup, outside the cluster.
• During rotation, keep the old version in the ring until deedbox keys rewrap reports that every tenant key is re-wrapped.