Configure an external key definition

task australia Updated Sep 10, 2026 2 min read ekms-configure-external-key-definition.md

Configure your external encryption key to use in External Key Management Service (EKMS).

Before you begin

Roles required: admin, security_admin, and sn_kmf.cryptographic_manager

Note: To configure EKMS, verify that you have an enabled key with your external key management provider, and the configured user has the necessary permissions to use the key.

The user must have permissions to run the following AWS KMS API operations:

kms:DescribeKey
kms:Encrypt
kms:Decrypt

Procedure

Navigate to All > System Security > Field Encryption > EKMS Configurations > New.

On the form, fill in the fields.

Field	Description
Application	Automatically populated with Global.
Cloud KMS Provider	Automatically populated with AWS.
EKMS Integration Name	Choose a name for the key definition. This name is referenced when running scripts.
Key Region	Enter the key region associated with your external key. Example: ex. us-east-2.
External Key Identifier	Enter the Amazon Resource Name (AWS ARN) for your external key.
Primary Region URL	Enter the unique Primary Regional URL that begins with KMS. Example: https://kms.[key region]_amazonaws.com.
KMS Credentials Access Key	Enter the key management service (KMS) for your credentialed AWS user.
KMS Credentials Secret Key	Enter the secret key for your credentialed AWS user.

Select Submit.

Result

The external key definition is configured. Verify that the key status displays as Active for the new configuration. To confirm if the key is usable, select Test EKMS Config. Wait for the key status to change to Active before using it.[Omitted image "ekms-active-key-definition.png"] Alt text: External Key Management Service key definition with an active status

What to do next

Next steps:

Parent Topic:Configuring External Key Management Service

64 lines · 3.4 KB Wrap lines

---
title: Configure an external key definition
description: Configure your external encryption key to use in External Key Management Service \(EKMS\).
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/ekms-configure-external-key-definition.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Configuring External Key Management Service, External Key Management Service, Field Encryption, Encryption]
---

# Configure an external key definition

Configure your external encryption key to use in External Key Management Service \(EKMS\).

## Before you begin

Roles required: admin, security\_admin, and sn\_kmf.cryptographic\_manager

**Note:** To configure EKMS, verify that you have an enabled key with your external key management provider, and the configured user has the necessary permissions to use the key.

The user must have permissions to run the following AWS KMS API operations:

-   kms:DescribeKey
-   kms:Encrypt
-   kms:Decrypt

## Procedure

1.  Navigate to **All** &gt; **System Security** &gt; **Field Encryption** &gt; **EKMS Configurations** &gt; **New**.

2.  On the form, fill in the fields.

    |Field|Description|
    |-----|-----------|
    |Application|Automatically populated with **Global**.|
    |Cloud KMS Provider|Automatically populated with **AWS**.|
    |EKMS Integration Name|Choose a name for the key definition. This name is referenced when running scripts.|
    |Key Region|Enter the key region associated with your external key. Example: ex. us-east-2.|
    |External Key Identifier|Enter the Amazon Resource Name \(AWS ARN\) for your external key.|
    |Primary Region URL|Enter the unique Primary Regional URL that begins with KMS. Example: https://kms.\[key region\]\_amazonaws.com.|
    |KMS Credentials Access Key|Enter the key management service \(KMS\) for your credentialed AWS user.|
    |KMS Credentials Secret Key|Enter the secret key for your credentialed AWS user.|

3.  Select **Submit**.


## Result

The external key definition is configured. Verify that the key status displays as Active for the new configuration. To confirm if the key is usable, select **Test EKMS Config**. Wait for the key status to change to Active before using it.\[Omitted image "ekms-active-key-definition.png"\] Alt text: External Key Management Service key definition with an active status

## What to do next

Next steps:

-   [Create a cryptographic module with external key wrapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/ekms-create-crypto-module.md)
-   [Create encrypted field configurations to specify which tables and columns to encrypt](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/ekms-create-encrypted-field-config.md)
-   [Set up module access policies to control who can view the encrypted data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/ekms-set-up-maps.md)
-   [Test an external key definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/ekms-test-external-key-definition.md)

**Parent Topic:**[Configuring External Key Management Service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/ekms-configuring-external-key-management.md)