# KMS Keys DuploCloud allows you to configure Tenant and Plan level KMS (Key Management Service) keys for AWS/Azure resources. These keys can be selected when creating supported resources to ensure consistent encryption and help meet compliance requirements. ## Adding a KMS Key for a Plan Plan-level KMS keys can be used for encrypting resources in any Tenant under the selected Plan. 1. Navigate to **Administrator** -> **Plans**. 2. Select the Plan from the **NAME** column. 3. Select the **KMS** tab. 4. Click **Add**. The **Add a Kms Key** pane displays.

5. Complete the following fields:

Field	User Action / What to Enter
Key Name	Enter a friendly name for the key (e.g., `test-key`)
Key Id	Enter the cloud provider–specific key ID (AWS KMS Key ID or Azure Key Vault Key ID).
Key Arn	Enter the cloud provider–specific key ARN or resource ID. For AWS this is the KMS Key ARN; for Azure, this is the Key Vault Key ID URI.

6. Click **Submit** to add the key to the Plan. Once added, the key can be selected when creating supported resources in the Plan, such as databases, compute instances, storage resources, and other services.

Plan **KMS** tab in the DuploCloud Portal

## Adding a KMS Key for a Tenant Tenant-level KMS keys can be used for encrypting resources only within the selected tenant. 1. Navigate to **Administrator** -> **Tenants**. 2. Select the Tenant from the **NAME** column. 3. Select the **KMS** tab. 4. Click **Add**. The **Add a Kms Key** pane displays.

5. Complete the following fields:

Field	User Action / What to Enter
Key Name	Enter a friendly name for the key (e.g., `test-key`)
Key Id	Enter the cloud provider–specific key ID (AWS KMS Key ID or Azure Key Vault Key ID).
Key Arn	Enter the cloud provider–specific key ARN or resource ID. For AWS this is the KMS Key ARN; for Azure, this is the Key Vault Key ID URI.

6. Click **Submit** to add the key to the Tenant. Once added, the key can be selected when creating supported resources in the Tenant.

Tenant **KMS** tab in the DuploCloud Portal

## Selecting a KMS Key When Creating Resources When creating a Host, RDS database, or other supported resource, select a KMS key to use for encrypting data at rest. 1. Navigate to the resource creation page (e.g., **Hosts**, **RDS**, or other supported resources). 2. Locate the **Encryption Key** or **KMS Key** field. 3. Choose a key from the options listed under **Default Tenant Key**, **Plan-level Keys**, or **Tenant-level Keys**.

4. Complete the rest of the resource creation steps as usual. {% hint style="info" %} **Note:** Only applicable resources will display these key options. Unsupported resources will continue to use the default tenant key. {% endhint %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.duplocloud.com/docs/automation-platform/security-and-compliance/access-control-1/at-rest-encryption/kms-keys.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.