Has anyone found a way to enable Shield Platform Encryption using SFDX? We've gotten it so that we can deploy Health Cloud with DX, but we also need to enable Shield Encryption for many of our test scenarios.
There's a few manuals steps to it or post setup:
- Ensure you enable the PlatformEncryption feature in your scratch org def file.
- You need to have a Permission Set that has "Manage Encryption Keys" permissions. For the sake of simplicity I assume this is a permission set called "EncryptionManagement".
- Once setup, push the source so that the permission set is available. Do not include any encrypted fields.
- Run the following commands:
sfdx force:user:permset:assign -n EncryptionManagement
sfdx force:data:record:create -s TenantSecret -v "Description='WHATEVER DESCRIPTION'"
- Redeploy the fields with encryption enabled.
- OPTIONAL: If you plan on using Deterministic Encryption you also need the following steps right after creating the first TenantSecret:
- Manual Step - Enable Deterministic Encryption in Encryption Settings
- Run sfdx force:data:record:create -s TenantSecret -v "Description='WHATEVER DESCRIPTION' Type=DeterministicData"
- Deploy the deterministically encrypted fields
This is a pretty manual flow and will require you to split up your push in 2 phases (with and without encrypted fields).
