# Encryption Key Management Services and Data Encryption Overview
![`smart`](CloudVendorKMSAndEncryption_en_001_20231008.png)
------------------------------------------------------------------------------
AWS Key Management Service and GCP Cloud Key Management Service deliver hardware master keys security with hardware security module (HSM). TiDB Cloud leverages those key management services to centrally manage master keys and data encryption keys for storage services.

TiDB Cloud utilizes AWS Key Management Service and GCP Cloud Key Management for master key and data key management.

AWS Key Management Service and GCP Cloud Key Management are capable of hosting encryption keys and perform cryptographic operations in FIPS 140-2 Level 3 validated HSMs. 

AWS Key Management Service and GCP Cloud Key Management are capable of generating, using, rotating, and destroying AES256, RSA 2048, RSA 3072, RSA 4096, EC P256, and EC P384 cryptographic keys. 

TiDB Cloud employs AES256 cryptographic keys as data encryption keys for encrypting and decrypting the disk volumes and files stored on the object storages. These keys are managed by the integrated storage services from AWS/GCP, rather than being managed by TiDB Cloud or any services developed by PingCAP.