---
title: Customer-managed encryption keys
description: Learn how to encrypt your InfluxDB 3 Cloud instance’s object storage with a key that you own in AWS Key Management Service (KMS) or Azure Key Vault.
url: https://docs.influxdata.com/influxdb3/cloud/admin/customer-managed-keys/
estimated_tokens: 400
product: InfluxDB 3 Cloud
version: cloud
publisher: InfluxData
canonical: https://docs.influxdata.com/influxdb3/cloud/admin/customer-managed-keys/
date: '2026-11-09T11:34:22-05:00'
lastmod: '2026-11-09T11:34:22-05:00'
---

Use a customer-managed key to encrypt your instance’s object storage with a key
that you own:

* **AWS**: A key in AWS Key Management Service (KMS)
* **Azure**: A key in Azure Key Vault

You can revoke InfluxData’s access to the data at any time.

To set up a customer-managed key, contact your InfluxData representative.

|                           |                         AWS                         |                         Azure                         |
|---------------------------|-----------------------------------------------------|-------------------------------------------------------|
|       **Encrypts**        |                  Amazon S3 objects                  |                  Azure Blob Storage                   |
|**Where the key is stored**|AWS Key Management Service (KMS), in your AWS account|    Azure Key Vault, in your Microsoft Entra tenant    |
|     **Existing data**     |Only objects written after you enable the key use it |All existing data uses the key as soon as you enable it|

> [!Warning]
> #### Deleting or disabling the key makes your data unusable
>
> If you delete or disable the key, neither you nor InfluxData can use the data
> in your instance’s object storage.
|  | AWS | Azure |
| --- | --- | --- |
|  | AWS | Azure |
| Encrypts | Amazon S3 objects | Azure Blob Storage |
| Where the key is stored | AWS Key Management Service (KMS), in your AWS account | Azure Key Vault, in your Microsoft Entra tenant |
| Existing data | Only objects written after you enable the key use it | All existing data uses the key as soon as you enable it |