---
schema_version: "1"
id: ca39aeb125b41a9f0b4139c1e3a0cd105f341f5c1bc156fcfffd18ead555ba96
title: Use an External KMS for Key Management
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/online/to_external_kms.md
canonical_url: https://help.tableau.com/v0.0/online/en-us/to_external_kms.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 7993b82288367e65c6f43d2ad1df90a700caa2c7c28b5de6183adcde2b62ef56
description: Use an external KMS for extract encryption keys on Tableau Cloud.
---
[Skip to main content](#main-content)

# Use an External KMS for Key Management

Many organizations require direct control over the encryption keys that protect their business-critical data. Using an external key management service (KMS) addresses this requirement by allowing customers to maintain control of their encryption keys with a trusted external key management vendor. By providing direct control over encryption keys, using an external KMS significantly enhances the security posture for organizations, particularly those concerned about unauthorized access to these critical keys.

Furthermore, for many organizations, the ability to control their encryption keys externally is crucial for meeting various regulatory and compliance mandates. And direct control over encryption keys assists organizations in maintaining data sovereignty, which is important for legal and geographical considerations of data storage and access.

As of February 2026, Tableau Cloud offers external key management exclusively through the Amazon Web Services (AWS) KMS.

Note: External KMS features are available starting with Tableau Cloud February 2026 if you have Tableau +, Tableau Enterprise, or Advanced Management. If at some point you no longer have Tableau +, Tableau Enterprise, or Advanced Management, working with your encrypted objects will still work, but you won't be able to manage keys.

## Features with external KMS support

You can use an external KMS to store encryption keys for:

- Extract encryption
- Data credentials encryption

Note: To use an external KMS for data credentials encryption, enable external KMS for extract encryption first.

Tableau encrypts both extracts and data credentials using the Salesforce-standard AES-GCM algorithm.

## Other articles in this section