> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Bring Your Own Key (BYOK)

> Encrypt Bronto data at rest using your own AWS KMS customer-managed key (BYOK) for tighter compliance, key rotation, and access control.

## Overview

Bronto supports **Bring Your Own Key (BYOK)** for **encryption at rest**.

When enabled, Bronto encrypts your data using **your own AWS KMS key**, giving you full control over key ownership, lifecycle, and access.

Bronto **never stores or manages your encryption key material**.

When BYOK is enabled:

* Newly ingested data stored in Bronto is encrypted at rest.
* You retain full control over key rotation, disablement, and deletion.

## Enabling Encryption Keys

Encryption keys are an **enterprise feature** and must be enabled by **Bronto Support**.

Once enabled, an **Encryption Keys** section becomes available in your organization settings.

## Creating the key in AWS

### 1) Create a customer-managed KMS key

1. Open **AWS Console → Key Management Service (KMS)**
2. Go to **Customer managed keys**
3. Click **Create key**
4. Choose:
   * **Key type:** Symmetric
   * **Key usage:** Encrypt and decrypt
   * **Region:** **Multi-Region key (Mandatory)**
5. Click **Next**

### 2) Set alias and rotation

1. Choose a key alias, for example:
   * `alias/bronto-archive-prod`
2. (Recommended) Enable **automatic key rotation**
3. Click **Next**

### 3) Set key administrators

1. Select your internal AWS admins or security team
2. These users can **rotate, disable, or delete** the key
3. Click **Next**

### 4) Set the key policy (Required)

Replace the default policy with the following customer key policy **(or add the second statement to the default)**.

This policy:

* Keeps full control with your AWS account root
* Allows Bronto to use the key only for encryption and decryption

```json theme={"dark"}
{
  "Version": "2012-10-17",
  "Id": "key-consolepolicy-3",
  "Statement": [
    {
      "Sid": "EnableIAMUserPermissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::xxx:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "AllowBrontoKmsUsage",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::637423326566:role/BrontoByok"
      },
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}
```

### 5) Copy the KMS Alias ARN

After creation:

1. Open the key in **KMS**
2. Go to the **Aliases** tab
3. Copy the **alias ARN**, for example:

```text theme={"dark"}
arn:aws:kms:eu-west-1:026090548703:alias/bronto-archive-prod
```

## Adding an Encryption Key in Bronto

To add a key once enabled on your account:

1. Go to **Settings → Encryption Keys**
2. Click **Add Encryption Key**
3. Enter:
   * **Display Name (optional)** — for identification inside Bronto
   * **AWS KMS Alias ARN** — the alias ARN of the KMS key you created in AWS
4. Click **Create**

<Callout type="note">
  The key will not be used until it has been activated and Bronto begins storing data for the organization.
</Callout>

***

## Activating the Key

To enable encryption at rest:

1. Open the key
2. Click **Activate Key**
3. Confirm the warning

Once activated:

* All newly ingested data is encrypted using this key.
* The **Last used** date of the key will indicate when this is working.
* The key **cannot be deactivated or replaced via the UI**.
* Reversal requires contacting **Bronto Support**.
* This action is intentional and treated as **permanent**.

***

## Important warnings

<Callout type="warning">
  <p><strong>Bronto has no control over your KMS key.</strong></p>

  <ul>
    <li>Disabling or deleting the key immediately breaks access to encrypted data.</li>
    <li>Bronto cannot recover data if the key is permanently lost.</li>
    <li>You are responsible for monitoring and managing key lifecycle.</li>
  </ul>
</Callout>