CCKM Licensing Model

CCKM is offered through the Trialware and Term License licensing models. This section describes these models and how to activate them.

• Trialware

• Term License

• Activating CCKM Licenses

Trialware

Provides the fully-functional CCKM solution for 90 days with pre-installed trial license. After the trial period expires, CCKM configurations on the CipherTrust Manager become read-only.

Term License

Provides the fully-functional CCKM solution for a prepaid charge for a specific period of time, for a specific number of cloud units.

This license comes with a grace period of 90 days. After the license period expires, the grace period starts. During the grace period, CCKM continues working normally. However, after the grace period is over, CCKM configurations on the CipherTrust Manager become read-only.

The CipherTrust Manager GUI starts showing a notification about the remaining license time. The license renewal can be ordered before the license expires.

Activating CCKM Licenses

Activating a CCKM license requires a license string for the CipherTrust Manager to which the AWS accounts, Azure subscriptions, and Google Workspace endpoints will be added. This string is generated when a license is activated. You can find the details about your EID and available licenses on the License Portal.

Refer to Activating a Connector License for details.

After the CCKM license is activated, its state becomes Active on the Features tab of the Licensing page of the CipherTrust Manager GUI. The license is displayed with the feature name CCKM.

License Enforcement for CCKM

Expected behavior with CCKM licenses is explained in this section.

• CipherTrust Manager appliance has activated Connector licenses: When CCKM licenses are activated and uploaded to a CipherTrust Manager, you can add clouds to the license capacity. This number cannot exceed the license count. Here is the list of clouds and related entities where the CCKM cloud licenses are enforced.

  Cloud	Enforced On
  AWS	AWS Accounts
  Azure	Azure Subscriptions
  Google	Google Projects
  Google Workspace CSE	Endpoints
  SFDC	SFDC Organizations
  SAP	SAP Applications
  Oracle	OCI Tenancies

  Note

  • Cloud license count is enforced on the containers added to the KMS Containers page of the Cloud Key Manager GUI, not on the cloud connections added to the CipherTrust Manager. So, until a container is added, no cloud license unit is consumed even if a cloud connection exists on the CipherTrust Manager.

    When one of the entities specified in the table above is added to the KMS Containers page, one CCKM cloud license unit is consumed. If two entities are added, two cloud license units are consumed, and so on.

  • Google Workspace CSE consumes one CCKM license (cloud unit) per endpoint. Endpoint URLs are assigned at the Google Workspace CSE Domain or Organization Unit (OU).

  • In the CipherTrust Manager 2.12 and older versions, Oracle BYOK was licensed based on OCI Compartments. Release 2.13 onward, the BYOK use case is licensed based on the OCI Tenancies.

  • The CipherTrust Manager acts as a Luna HSM client for root of trust (RoT) and CCKM Embedded (with Luna HSM as a key source). Separate client licenses for Luna HSMs are not required on the CipherTrust Manager. However, you need to apply usual partition licenses on the Luna HSM side.

• Reaching license capacity: Additional accounts cannot be added because the license count has been exhausted. In this case, (for example, for AWS), users can delete currently configured AWS accounts or buy additional licenses to add more accounts.

• License expires: The CipherTrust Manager GUI displays a red banner to inform the administrator of expired licenses. At this time, no new cloud license enforced entities can be added. However, users can still manage currently added accounts for 90 days from license expiry. After 90 days, the CCKM configurations on the CipherTrust Manager become read-only.