## Set up customer managed keys

URL: https://docs.atlan.com/product/administration/how-tos/set-up-customer-managed-keys

> Learn how to set up customer managed keys to protect the secrets and credentials stored in Atlan.

<!--vale off-->

# Set up customer managed keys 

<!--vale on-->

You can set up customer managed keys to protect secrets stored in Atlan (for example, connection credentials). CMK is available in private preview for AWS-hosted tenants.

## Prerequisites

Before you begin, make sure you have:

- Admin permissions in Atlan.
- An AWS-hosted Atlan tenant. CMK doesn't work for Azure-hosted or GCP-hosted tenants.
- A planned maintenance window for activation or rotation (Atlan support coordinates the migration).

## Upload your key

1. Generate a 256-bit (32-byte) **symmetric** key and store it securely. You can generate this locally on a secured machine, using an HSM-backed process, or through internal key generation tooling.

 Generate the key using a method approved by your security team (for example, a hardened workstation, an HSM-backed workflow, or an internal key generation process). Don't use an asymmetric key (RSA or ECC) or a passphrase.

 Example: Generate a 32-byte key with OpenSSL

 ```bash
 openssl rand -out atlan-cmk.key 32
 ```

 Example: Generate a 32-byte key with Python

 ```python
 import secrets

 with open("atlan-cmk.key", "wb") as f:
 f.write(secrets.token_bytes(32))
 ```

 :::info
 Losing this key can permanently block access to secrets protected by the vault. Store backups in a secure, redundant location approved by your security team.
 :::

2. In your Atlan workspace, click **Settings**, and then click **Authentication**. Scroll to the **Keys** section at the bottom of the page.

 If you are using the **Old UI (Classic)**, from the left menu in Atlan, click **Admin**, and then click **Authentication**. Scroll to the **Keys** section at the bottom of the page.

 If you don't see the customer managed keys section, [raise a support request](https://docs.atlan.com/support/submit-request) to request private preview access.

3. In the customer managed keys section, upload your key. Atlan validates the key before accepting it.

4. After you upload your key, [raise a support request](https://docs.atlan.com/support/submit-request) to activate CMK. Include your tenant name, confirmation that the CMK is uploaded in **Authentication**, and your preferred maintenance window.

5. After Atlan completes the migration, you receive a confirmation from Atlan.

 To verify that the CMK is active, go to **Authentication** and confirm that the CMK status shows **Active** in the Customer managed keys section.

 If you want to rotate or update your CMK, generate a new 256-bit symmetric key and store it securely, upload the new key from the Authentication page, and raise a support request to schedule the key rotation.

## Remove customer managed keys

To revert to Atlan-managed keys, [raise a support request](https://docs.atlan.com/support/submit-request). Atlan support coordinates the migration back to platform-managed encryption.

## Need help?

For setup, activation, rotation, or removal, contact [Atlan support](https://docs.atlan.com/support/submit-request).

## See also

- [Encryption and key management](https://docs.atlan.com/platform/concepts/encryption-and-key-management)
- [Product release stages](https://docs.atlan.com/llms/platform/get-started/product-release-stages/llms.txt)

---