Create an external key store and keys

Create an external key store

  1. Sign in to the AWS management console and navigate to Key Management Service (KMS).

  2. In KMS, go to Custom key stores > External key stores.

  3. Select Create external key store.

  4. Enter the information as shown below, then select Create external key store.

    Parameter Value

    Proxy connectivity

    VPC endpoint service

    VPC endpoint service name

    Name from VPC Endpoint Service

    Proxy URL endpoint

    URL containing the FQDN, for example, https://nshield-xks.entrust.com

    Proxy URI path prefix

    /nshield/xks

    Proxy credential: Access key ID

    sigv4_access_key_id from Configure XKS PRoxy

    Proxy credential: Secret access key

    sigv4_secret_access_key from Configure XKS Proxy

    The following example shows a newly created external key store. Notice the Connection state is Disconnected.

    create external keystore 1

  5. Connect the newly created external key store. From the Key store actions menu, select Connect. After the connection process completes, verify the updated Connection state.

    create external keystore 2

After you create the External key store, you can use it to securely manage and store keys in your AWS environment.

Create a key in an external key store

  1. Sign in to the AWS management console and navigate to Key Management Service (KMS).

  2. In KMS, select the key store created in section Create an external key store.

  3. Select Create a KMS key in this key store.

  4. In the Configure key for external key store window, complete the following fields and then select Next:

    create key external keystore 1

  5. In the Add label window, enter a name and description for the KMS key. Select Next to continue.

  6. In the Define key administrative permissions window, select the IAM user or users designated as administrators.
    In the Define key usage permissions window, select the IAM user or users designated as key users.

    This example uses a single key administrator and a single key user. However, AWS KMS supports assigning multiple IAM users and roles to each permission set.

    Select Next to continue.

    For example:

    create key external keystore 2

  7. In the Edit key policy - optional window, select Next.

  8. In the Review window, select Finish.

    The key is created and the key information is displayed:

    create key external keystore 3