Acquia Connector now supports Key module and PKS integration

What's New

Acquia Connector now integrates with the Key module and Acquia's Product Key Injection Services (PKS), providing secure credential management for Acquia product subscriptions. You can now store Acquia credentials using the Key module instead of directly in configuration, with enhanced security through PKS integration.

New capabilities:

• Acquia Key Provider - Store credentials via the Key module
• PKS Integration - Retrieve credentials securely from Acquia's Product Key Injection Services
• Encrypted token storage - Tokens encrypted and tied to environment
• Environment-aware security - Credentials invalidate when databases move between environments

How to Use

Option 1: Using Key Module (Recommended)

• Install the Key module: composer require drupal/key
• Create an Acquia key at /admin/config/system/keys/add
• Select "Acquia" as the Key provider
• Configure the key to use PKS - Credentials fetched from Acquia Platform Key Service
• Navigate to product configuration form
• Select your Acquia key from the dropdown
• Save configuration

Option 2: Direct Configuration (Legacy)

Continue using direct credential input. This method still works.

PKS Integration Details

How PKS works:

• Credentials are retrieved from Acquia's Product Key Injection Services
• Tokens are encrypted using JWT hashes tied to the current environment
• Encrypted tokens stored using key_value_expire service
• When database moves between environments, tokens automatically invalidate (security feature)
• Falls back to direct configuration if PKS unavailable

Credential retrieval order:

• Check encrypted cache (key_value_expire)
• Fetch from PKS if cache miss
• Fall back to direct configuration if all else fails

Security Benefits

PKS Integration:

• Credentials never stored in plain text in database
• Environment-specific encryption prevents credential leakage across environments
• Database exports/imports don't expose credentials
• Automatic invalidation when moving databases

Key Module:

• Centralized credential management
• Supports various Key providers (File, Environment, PKS, etc.)
• Integration with enterprise key management systems
• Credentials excluded from configuration exports

On Acquia Cloud, PKS integration works automatically:

• Credentials are fetched from Product Key Injection Services
• No manual configuration needed for connected environments
• Tokens refresh automatically
• Secure by default

Migration from Direct Configuration

Existing sites using direct credentials:

• No immediate action required - direct configuration continues to work
• Recommended: Migrate to Key module for enhanced security
• Create Acquia key with PKS or Environment provider
• Update Acquia product module's settings to use the key
• Old credentials can be removed from configuration

No data loss: Switching between methods preserves your connection.

Benefits

✅ Enhanced security - Encrypted, environment-aware credential storage
✅ PKS integration - Seamless credential management on Acquia Cloud
✅ Key module support - Centralized credential management
✅ Environment isolation - Credentials don't leak between environments
✅ Backward compatible - Existing configurations continue to work