This section describes the workflow that occurs in the Cryptographic Security Platform Vault for Cloud Keys when you use BYOK for AWS.

AWS Workflow

To bring your own key

  1. Vault creates a Cloud Key with key material. If HSM is configured, the key is generated and wrapped with a root key on the HSM.

  2. AWS Key Management Service (KMS) creates a customer master key (CMK) with no key material associated.

  3. Download the RSA-2048 wrapping public key and the import token from AWS KMS.

  4. Import the RSA-2048 wrapping public key and the import token into Vault.

  5. The imported wrapping key rewraps the symmetric key. If an HSM is configured, the HSM performs the wrapping.

  6. Import the symmetric key into AWS KMS using the import token.