---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Configure an external key definition

# Configure an external key definition {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Configure your external encryption key to use in External Key Management Service (EKMS).

## Before you begin

Roles required: admin, security_admin, and sn_kmf.cryptographic_manager  
Note:  
To configure EKMS, verify that you have an enabled key with your external key management provider, and the configured user has the necessary permissions to use the key.  
The user must have permissions to run the following AWS KMS API operations:

* kms:DescribeKey
* kms:Encrypt
* kms:Decrypt
{#ekms-configure-external-key-definition__ul_dtn_fsf_m3c}

## Procedure

1. Navigate to AllSystem SecurityField EncryptionEKMS ConfigurationsNew.
2. On the form, fill in the fields.  
   {#ekms-configure-external-key-definition__table_t3n_lcq_g3c__entry__2}

   | Field | Description |
   |-|-|
   | Application | Automatically populated with Global. |
   | Cloud KMS Provider | Automatically populated with AWS. |
   | EKMS Integration Name | Choose a name for the key definition. This name is referenced when running scripts. |
   | Key Region | Enter the key region associated with your external key. Example: ex. us-east-2. |
   | External Key Identifier | Enter the Amazon Resource Name (AWS ARN) for your external key. |
   | Primary Region URL | Enter the unique Primary Regional URL that begins with KMS. Example: https://kms.\[key region\]_amazonaws.com. |
   | KMS Credentials Access Key | Enter the key management service (KMS) for your credentialed AWS user. |
   | KMS Credentials Secret Key | Enter the secret key for your credentialed AWS user. |
   [ ]

   {#ekms-configure-external-key-definition__table_t3n_lcq_g3c}
3. Select Submit.

## Result

The external key definition is configured. Verify that the key status displays as Active for the new configuration. To confirm if the key is usable, select Test EKMS Config. Wait for the key status to
change to Active before using it.

## What to do next

Next steps:

* [Create a cryptographic module with external key wrapping](https://www.servicenow.com/docs/0jl83kS7Ey61YmoBIkMvjg "Create a cryptographic module that uses external Amazon Web Services Key Management System (AWS KMS) key wrapping to encrypt ServiceNow data.")
* [Create encrypted field configurations to specify which tables and columns to encrypt](https://www.servicenow.com/docs/LrJ3Hf40r26dNUMShsEvRw "Configure specific fields to be encrypted using your External Key Management Service (EKMS) cryptographic module with external Amazon Web Services Key Management System (AWS KMS) key wrapping.")
* [Set up module access policies to control who can view the encrypted data](https://www.servicenow.com/docs/yP8ydWgSMIloOWt9PkqvHw "Configure module access policies in External Key Management Service (EKMS) to control who can view encrypted data in clear text.")
* [Test an external key definition](https://www.servicenow.com/docs/wY5Z6gn7~Nq5619rd9hhWg "Test your external encryption key to use in External Key Management Service (EKMS).")
{#ekms-configure-external-key-definition__ul_e1f_dch_g3c}

*[\>]: and then