{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40849,"path":"platform-security/configure-script-encryption.md","title":"Configure script access to encrypted data","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure script access to encrypted data\n\nExecute a script to run the cryptographic module policy for a cryptographic purpose. Specific read \\(decrypt/unwrap\\) or write \\(encrypt, wrap\\) access can be defined based on the module access policy operation granularity.\n\n## Before you begin\n\nRole required: sn\\_kmf.cryptographic\\_manager\n\n## About this task\n\nExamples of uses are for Business Rules and Script Includes. This procedure uses a script for Business Rules.\n\n## Procedure\n\n1.  Create a cryptographic module with the symmetric data encryption/decryption algorithm.\n\n    Refer to [Create a cryptographic module](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/platform-encryption/create-cryptographic-module.md) for details. Specific access to the data or attachment is controlled with a module access policy with the following characteristics:\n\n    -   Symmetric encryption: The script is able to encrypt data but unable to decrypt the data.\n    -   Symmetric decryption: The script is able to decrypt uploaded encrypted data or attachment but unable to encrypt data or attachments.\n    -   Symmetric encryption and decryption: The script is able to both encrypt and decrypt data or attachments.\n2.  Navigate to **System Definition** &gt; **Business Rules**.\n\n3.  Click **New**.\n\n    \\[Omitted image \"business-rule-script.png\"\\] Alt text: New Business Rule record.\n\n4.  Complete the form on the **When to run** tab and enter the script on the **Advanced** tab:\n\n<table id=\"table_hvx_5lw_d4b\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nEnter a name for the business rule.\n\n</td></tr><tr><td>\n\nTable\n\n</td><td>\n\nSelect **Incident \\[incident\\]**from the drop-down list.\n\n</td></tr><tr><td>\n\nApplication\n\n</td><td>\n\n**Global** is selected by default.\n\n</td></tr><tr><td>\n\nActive\n\n</td><td>\n\nMark the rule as **Active**.\n\n</td></tr><tr><td>\n\nAdvanced\n\n</td><td>\n\nSelect the check box to display advanced options.\n\n</td></tr><tr><td>\n\nWhen to run tab\n\n</td><td>\n\nOn the **When to run** tab, enable **Insert** and **Update** fields.\n\n</td></tr><tr><td>\n\nAdvanced tab\n\n</td><td>\n\nOn the **Advanced** tab, paste the following script text at line 3: ```\n\nvar gc = global.GlideCryptoModule.getModule('global.acme_mod');\nvar value = 'test';\nvar encrypted = gc.encryptData(value);\ngs.info('value: ' + value);\ngs.info('Encrypted: ' + encrypted);\nvar decrypted = gc.decryptData(encrypted);\ngs.info('Decrypted: ' + decrypted);\ngs.info(decrypted == value);\n\n```\n\n **Note:** Refer to the \"Business Rules Advanced Tab\" image for details.\n\n</td></tr></tbody>\n</table>    \\[Omitted image \"business-rules-advanced.png\"\\] Alt text: Business Rule Advanced tab.\n\n5.  Select **Submit**.\n\n6.  Navigate to **All** &gt; **System Security** &gt; **Field Encryption** &gt; **Field Encryption Experience** &gt; **Configurations** &gt; **Access Policies** &gt; **** **All**.\n\n    **Note:** For additional information, refer to [Create a module access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/platform-encryption/create-module-access-policy.md).\n\n7.  Select **Create new**.\n\n8.  Select an existing Field Encryption module to associate the Module Access Policy \\(MAP\\) with.\n\n9.  Select **Create**.\n\n10. Complete the form.\n\n    \\[Omitted image \"fe-create-map.png\"\\] Alt text: Target script selection.\n\n    Module Access Policies fields\n\n    |Field|Description|\n    |-----|-----------|\n    |Policy name|Enter a name for the policy.|\n    |Type|Select **Script** to control access by script.|\n    |Script Table|Select a value from the script table drop-down list. For this example, select **Business Rule \\[sys\\_script\\]**.|\n    |Result|To give the script access to the module, select **Track** in the **Result** field.|\n    |Crypto module|Displays the module with the symmetric data encryption/decryption algorithm that you selected.|\n    |Active|Select to activate the policy.|\n    |Target Script|Select the script document for the policy. Select the **Table name** and then the related document for the policy. For this example, select the Business Rule that you created in previous steps.|\n    |Check script version|Select this option to direct the system to perform a version comparison anytime the script is run. If the script has been changed, the user is notified.|\n    |Specify purpose|Optional. Enable  to  display  the  Crypto  Spec field  on  the  form.  Enable this option to configure granular operations, such as some users being able to encrypt, but not decrypt.|\n    |Application|The  Application scope  is  auto-populated  by  your  current scope. |\n\n11. Select **Save**.\n\n    The Module Access Policy for the script is now available in the system.\n\n\n-   **[View declined cryptographic module usage requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/view-declined-crypto-module-usage-requests.md)**  \nView cryptographic modules that rejected encryption requests made by scripts because of unsupported encryption mechanisms.\n\n**Parent Topic:**[Script access for cryptographic modules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/script-map.md)\n\n"}}