> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Use AWS KMS for Infisical encryption

> Learn how to manage encryption using AWS KMS

To enhance the security of your Infisical projects, you can now encrypt your secrets using an external Key Management Service (KMS).
When external KMS is configured for your project, all encryption and decryption operations will be handled by the chosen KMS.
This guide will walk you through the steps needed to configure external KMS support with AWS KMS.

## Prerequisites

* An AWS KMS Key configured as a `Symmetric` key and with `Encrypt and Decrypt` key usage.

  ![Create AWS KMS Key](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws/aws-kms-key-create.png)

Before you begin, you'll first need to choose a method of authentication with AWS from below.

> [tab] Method 1: Assume Role (Recommended)
>
> **1. Create the Managing User IAM Role**
>
> 1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
>
>    ![IAM Role Creation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integration-aws-iam-assume-role.png)
>
> 2. Select **AWS Account** as the **Trusted Entity Type**.
>
> 3. Select **Another AWS Account** and provide the appropriate Infisical AWS Account ID: use **381492033652** for the **US region**, and **345594589636** for the **EU region**. This restricts the role to be assumed only by Infisical. If you're self-hosting, provide the AWS account number where Infisical is hosted.
>
> > [!NOTE]
> >
> > **For Dedicated Instances**: Your AWS account ID differs from the one provided above. Please reach out to Infisical support to obtain your AWS account ID.
>
> 4. Optionally, enable **Require external ID** and enter your Infisical **project ID** to further enhance security.
>
> **2. Add Required Permissions for the IAM Role**
>
> Use the following custom policy to grant the minimum permissions required by Infisical to integrate with AWS KMS
>
> ```json theme={"dark"}
> {
>   "Version": "2012-10-17",
>   "Statement": [
>     {
>       "Sid": "AllowKMSAccess",
>       "Effect": "Allow",
>         "Action": [
>           "kms:Decrypt",
>           "kms:Encrypt",
>           "kms:DescribeKey"
>       ],
>       "Resource": "*"
>     }
>   ]
> }
> ```

> [tab] Method 2: Access Key
>
> Navigate to your IAM user and add a policy to grant the following permissions:
>
> ```json theme={"dark"}
> {
>   "Version": "2012-10-17",
>   "Statement": [
>     {
>       "Sid": "AllowKMSAccess",
>       "Effect": "Allow",
>         "Action": [
>           "kms:Decrypt",
>           "kms:Encrypt",
>           "kms:DescribeKey"
>       ],
>       "Resource": "*"
>     }
>   ]
> }
> ```

## Setup AWS KMS in the organization settings

Next, you'll need to follow the steps listed below to add AWS KMS for your organization.

**1. Open the Encryption settings**

Go to **Settings**, select **Encryption**, then select **Add KMS**.

![Open encryption org settings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/encryption-org-settings.png)

**2. Select AWS KMS**

![Select Encryption Provider](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/encryption-modal-provider-select.png)

Choose **AWS KMS** from the list of encryption providers.

**3. Provide the inputs for AWS KMS**

Selecting AWS as the provider will require you input the following fields.

**Alias** `string` *required*

Name for referencing the AWS KMS key within the organization.

**Description** `string`

Short description of the AWS KMS key.

**Authentication Mode** `string` *required*

Authentication mode for AWS, either "AWS Assume Role" or "Access Key".

**IAM Role ARN For Role Assumption** `string`

ARN of the AWS role to assume for providing Infisical access to the AWS KMS Key (required if Authentication Mode is "AWS Assume Role")

**Assume Role External ID** `string`

Custom identifier for additional validation during role assumption.

**Access Key ID** `string`

AWS IAM Access Key ID for authentication (required if Authentication Mode is "Access Key").

**Secret Access Key** `string`

AWS IAM Secret Access Key for authentication (required if Authentication Mode is "Access Key").

**AWS Region** `string` *required*

AWS region where the AWS KMS Key is located.

**AWS KMS Key ID** `string`

Key ID of the AWS KMS Key. If left blank, Infisical will generate and use a new AWS KMS Key in the specified region.

![AWS KMS key ID](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws/aws-kms-key-id.png)

**4. Save the configuration**

Select **Save** to apply the settings.

You now have an AWS KMS Key configured at the organization level. You can assign these AWS KMS keys to existing Infisical projects from the project's **Settings** page.

## Assign AWS KMS key to an existing project

To assign the AWS KMS key you added to your organization, follow the steps below.

**1. Open the project's Encryption settings**

Open the project, go to **Settings**, and select **Encryption**.

![Open encryption project
settings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws/encryption-project-settings.png)

**2. Select the key under Key Management**

![Select encryption project
settings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws/encryption-project-settings-select.png)

Choose the AWS KMS key you configured earlier.

**3. Save the change**

Once you have selected the KMS of choice, select **Save**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.