---
schema_version: "1"
id: eedbc2bec5926778d5338395af95c4547cacac671e44ec113d3f13ff8a5dbc7e
title: Create AWS Key to Encrypt Your Data
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/ind/264-0-0/admin_encryptdata.md
canonical_url: https://help.salesforce.com/s/articleView?id=ind.admin_encryptdata.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a1e9a4843feae681e8c24e84f6ad12bc408200930d1d9060165468fcda7f11f1
description: If you have enabled Salesforce Files, add another layer of data protection and encrypt your data by using Amazon Web Services (AWS). Encrypt data by using your own keys.
products:
  - Industry Solutions
  - Cross Cloud
release: "264"
---
# Create AWS Key to Encrypt Your Data

If you have enabled Salesforce Files, add another layer of data protection and encrypt your data by using Amazon Web Services (AWS). Encrypt data by using your own keys.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Unlimited</strong> Edition with Einstein Relationship Insights Basic</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available for an additional cost in:&nbsp;<strong>Enterprise</strong>,&nbsp;<strong>Performance</strong>, and <strong>Unlimited</strong>&nbsp;Editions</td></tr></tbody></table>

Before you set up data encryption:

- Set up Salesforce Files. See [Connecting with Salesforce Files](https://help.salesforce.com/s/articleView?id=ind.concept_connect_sffiles.htm&release=264.0.0&type=5 "Connect with Salesforce Files so that your sales reps can explore the documents in Salesforce Files, including the files in Chatter feeds and comments, records, and libraries. Discover more connections and build a network of people and companies by exploring documents in Salesforce Files. View the notes captured by interaction summaries and expand the scope of your relationship recommendations.").
- From the Einstein Relationship Insights component, copy the AWS region and AWS account ID. See [Copy the AWS Region and AWS Account ID](https://help.salesforce.com/s/articleView?id=ind.admin_copyaws.htm&release=264.0.0&type=5 "Before you encrypt your data by using Amazon Web Services, copy the AWS region and account ID from the Einstein Relationship Insights component.").

1. Log in to your AWS console.
2. Select the AWS region that matches the region on the Einstein Relationship Insights component settings page.
3. Create a key with an alias and key ID.
    1. In the search field, enter KMS, and then select **Key Management Service**.
    2. Click **Create a key**.
    3. In the Configure key step, select the **Symmetric** key type and the **Encrypt and decrypt** key usage.
        
        To import externally managed key material, see [Importing key material in AWS KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html).
    4. Click **Next**.
    5. In the Add labels step, add a unique alias for the KMS key, and click **Next**.
    6. In the Define key administrative permissions step, select an admin user.
    7. Select **Allow the administrators to delete this key**, and click **Next**.
    8. In the Define Key usage permissions step, under Other AWS accounts, click **Add another AWS account**, and paste the AWS account ID copied from the Einstein Relationship Insights component settings page.
    9. Click **Next**.
    10. In the Review step, review the key configuration and other details.
    11. Click **Finish**.
4. Copy the Alias ARN. Go to **KMS** | **Customer-managed keys** | **Key**. Click the **Aliases** tab, and then click ![Copy icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ind-einstein_relationship_insights-264-0-0-production-enus/25688f08-eca1-49f0-a817-8b03d5b57ea7/einstein_relationship_insights/images/eri_copy_icon.png).
5. On the Einstein Relationship Insights component settings page, under Salesforce Files content source, enter the AWS key or alias ARN.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ind-einstein_relationship_insights-264-0-0-production-enus/25688f08-eca1-49f0-a817-8b03d5b57ea7/images/icon_note.png)
    
    Note We recommend that you enter the Alias ARN to ensure that the data key is updated during automatic key rotation.
    
    - Example of an AWS key:
        
        ```
        arn:aws:kms:us-east-2:123412341234:key/9e09e569-b0c8-4e2c-8364-35eaef36341e
        ```
    - Example of an Alias ARN:
        
        ```
        arn:aws:kms:us-east-2:123412341234:alias/example-alias-valuetesting
        ```
6. To automatically update your data keys during manual rotation, select **Rotate Data Keys**.
7. Save your changes.

The Einstein Relationship Insights component shows the AWS KMS key, which can be used to encrypt your data.

- **[Copy the AWS Region and Account ID](https://help.salesforce.com/s/articleView?id=ind.admin_copyaws.htm&release=264.0.0&type=5)**  
    Before you encrypt your data by using Amazon Web Services, copy the AWS region and account ID from the Einstein Relationship Insights component.
- **[Automatic Re-Encryption of Data](https://help.salesforce.com/s/articleView?id=ind.admin_encryption_rotation.htm&release=264.0.0&type=5)**  
    If you enable automatic key rotation for your AWS Key Management Service (KMS) key, AWS rotates the root key material annually. During the root key rotation, the system rotates your data key, which is used to encrypt and re-encrypt the data.