If Salesforce record fields are encrypted with Shield Platform Encryption, changes in encrypted field values generate change events. Change events are stored in the event bus for up to three days. To ensure that the events stored in the event bus are encrypted and not in clear text, create an event bus tenant secret and enable encryption.
To enable encryption of change events, first create an event bus tenant secret on the Key Management page in Setup. Then enable encryption of change events on the Encryption Policy page.
You must create an event bus tenant secret before enabling encryption. From Setup, the encryption setting is available only after you create an event bus tenant secret. In Metadata API, if you enable encryption using PlatformEncryptionSettings without having the tenant secret, you get an error.
Warning
Generate an Event Bus Tenant Secret
To enable encryption of change events, first generate an event bus tenant secret.
Enable Encryption of Change Events
After you create an event bus tenant secret, a setting becomes available in the Encryption Settings page that starts encryption of change events.
Capturing Changes and Encrypting the Event Payload
After capturing record changes, Change Data Capture creates a change event and stores it in the event bus. Because data changes are captured internally on the application servers in decrypted form, they must be encrypted before storing the corresponding change event that contains them. The entire event payload is encrypted using the data encryption key that is based on the Event Bus tenant secret type.
See Also
j
