Set Up BYOK on AWS KMS

Customer-managed encryption keys (BYOK) mean your files are encrypted with a key that lives entirely in your own AWS account — BYOVault never has independent access to it. This takes about 10 minutes and does not touch anything already backed up.

1. Create a KMS key

  1. Go to the AWS KMS console → Customer managed keys → Create key.
  2. Key type: Symmetric. Key usage: Encrypt and decrypt.
  3. Give it an alias (e.g. acme-byok-key) for identification in the console.
  4. On the Key administrators step, pick whoever on your side should be able to manage this key’s lifecycle (disable, schedule deletion, rotate). BYOVault is never an administrator of your key — only a user of it, granted in the next step.
  5. On the Key usage permissions step, skip adding BYOVault here — key-policy access for a different AWS account is not available in this step’s key-usage picker. You will add it directly to the key policy in step 2 instead.
  6. Review and finish creating the key.
Enable a deletion window you're comfortable with
AWS holds a deleted KMS key in a recoverable, pending-deletion state for a grace period you choose (7–30 days) before it’s permanently, irreversibly destroyed. BYOVault’s health check relies on this window to warn you before that happens. The default (30 days) is appropriate for most customers.

2. Grant BYOVault's proxy role access to your key

Unlike Azure, AWS does not require installing an app into your account. Authorization is a single statement you add directly to your key’s own resource policy, granting BYOVault’s dedicated proxy role permission to use (never export) your key.

  1. Open the key you just created → Key policy tab.
  2. If you see sections like “Key administrators” instead of raw JSON, click Switch to policy view first.
  3. Click Edit, then add the following statement inside the existing Statement array, alongside the ones AWS already put there — do not remove those:
{
  "Sid": "AllowBYOVaultProxyToUseThisKey",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::460223322928:role/byovault-prod-byok-kms-proxy-role"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey",
    "kms:DescribeKey"
  ],
  "Resource": "*"
}

Save the policy.

Wrap/unwrap only — never raw key export
This statement permits using the key to encrypt/decrypt data, never extracting the key material itself. No party, including BYOVault, can export your raw key through this grant. KMS enforces both sides of a grant: even though the statement’s Resource: "*" refers broadly to resources, this role can only act on THIS key, because only this key’s own policy names it.

3. Copy your key's ARN and region

On the key’s own page, copy its ARN (starts with arn:aws:kms:, shown under “General configuration”).

The region is not printed alongside it — it is whatever region the console’s selector, top-right corner, was set to when you created the key (e.g. us-east-1).

Region defaults to us-east-1 if left blank
The region field in step 4 is optional, but it defaults to us-east-1. If your key was created in any other region, you must fill in the region field explicitly. Otherwise BYOVault will issue wrap/unwrap calls against the wrong region, and key verification and subsequent backups will fail.

4. Enter it into BYOVault

On the tenant’s own Encryption Key page, choose AWS KMS. Paste in your key’s ARN and region, then click Verify and activate.

BYOVault performs a real wrap/unwrap round trip against your key before saving — a missing key-policy statement or a typo in the ARN is caught here, not discovered later at your first backup.

Disabling vs. deleting your key
Disabling your key in KMS is instant and fully reversible — BYOVault’s daily health check will detect it and alert you, and re-enabling it restores everything immediately. Scheduling deletion is different: AWS holds it for the grace period you chose in step 1, after which it is permanently, irreversibly gone — and so is every file BYOVault encrypted with it. Disable a key you want to pause; never schedule deletion for one you might still need.

See The Shared Master Key for how this compares to BYOVault’s default shared-master-key path.

PreviousBYOK on Azure Key VaultNextOverview