Secure storage of anchor passphrase for DBMS

A computer-implemented method, the method comprising:

• receiving, by a database service from an encryption service of a database provider in a cloud environment, an encryption key passphrase;
• encrypting a key storage managed by the database service using the encryption key passphrase, the key storage storing one or more encryption keys used by the database service;
• storing an encrypted backup of the key storage in an object store of the database service;
• and
• storing the passphrase in a secure storage that is separate and distinct from the object store of the database service and a data persistence of the database service.

A non-transitory, computer readable medium storing instructions, which when executed by at least one processor cause a computer to perform a method comprising:

• receiving, by a database service from an encryption service of a database provider in a cloud environment, an encryption key passphrase;
• encrypting a key storage managed by the database service using the encryption key passphrase, the key storage storing one or more encryption keys used by the database service;
• storing an encrypted backup of the key storage in an object store of the database service;
• and
• storing the passphrase in a secure storage that is separate and distinct from the object store of the database service and a data persistence of the database service.