---
schema_version: "1"
id: 4707e9b86dec67c88e4d22e68dfbd1a5962e2807d174984a31fa747b3151ba1a
title: Use an External KMS for Key Management
collection: tableau
version: current
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/current/en-gb/online/to_external_kms.md
canonical_url: https://help.tableau.com/current/online/en-gb/to_external_kms.htm
source_site: help.tableau.com
content_type: documentation
content_hash: f68ff3f54c0e737539df2f79c41ffa82e44e4e80caef9c341259617b74476430
description: Use an external KMS for extract encryption keys on Tableau Cloud.
---
[Skip to main content](#main-content)

# Use an External KMS for Key Management

Many organisations require direct control over the encryption keys that protect their business-critical data. Using an external key management service (KMS) addresses this requirement by allowing customers to maintain control of their encryption keys with a trusted external key management vendor. By providing direct control over encryption keys, using an external KMS significantly enhances the security posture for organisations, particularly those concerned about unauthorised access to these critical keys.

Furthermore, for many organisations, the ability to control their encryption keys externally is crucial for meeting various regulatory and compliance mandates. And direct control over encryption keys assists organisations in maintaining data sovereignty, which is important for legal and geographical considerations of data storage and access.

As of February 2026, Tableau Cloud offers external key management exclusively through the Amazon Web Services (AWS) KMS.

Note: External KMS features are available starting with Tableau Cloud February 2026 if you have Tableau +, Tableau Enterprise or Advanced Management. If at some point you no longer have Tableau +, Tableau Enterprise or Advanced Management, working with your encrypted objects will still work, but you won’t be able to manage keys.

## Features with external KMS support

You can use an external KMS to store encryption keys for:

- Extract encryption
- Data credentials encryption

Note: To use an external KMS for data credentials encryption, enable external KMS for extract encryption first.

Tableau encrypts both extracts and data credentials using the Salesforce-standard AES-GCM algorithm.

## Other articles in this section