# `PARAMETER::` Encryption at Rest - Key Management
![`smart`](CloudVendorKMSAndKeyManagement_en_001_20231008.png)
+ **Master keys** are managed by AWS/GCP hardware security module (HSM) compliant to FIPS 140-2 Level 3
+ **Master keys** can be managed and supplied by customer (for TiDB Dedicated on AWS only)
+ **Data encryption keys** are managed by AWS/GCP

------------------------------------------------------------------------------
TiDB Cloud does not store master keys and data encryption keys; instead, they are generated, hosted, and managed by AWS and GCP key management services. These master keys are utilized for encrypting and decrypting symmetric data encryption keys, which in turn are used for encrypting and decrypting disk volumes and files on object storages.

Master keys never leaves Cloud Infrastructure vendor key management services. Master key can be managed by PingCAP or customer.

Data encryption keys never leaves Cloud Infrastructure vendor key management services unencrypted. 

In conclusion, there are four key points:
- PingCAP will not obtain the master key, but only grant the privileges for using the master key within Key Management services to underlying AWS/GCP integrated storage services.
- AWS/GCP uses master key to encrypt/decrypt the data key.
- The data key, in the integrated block storage and object storage only stores the encrypted ciphertext. Therefore, to encrypt or decrypt data using the data key, it is necessary to first request the use of the master key, from KMS to decrypt the data key, and this process is conducted by AWS (EBS, S3) and GCP (Persistent Disk, Cloud Storage) automatically.

Additional references:
- AWS Key Management Service and how it works - `https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html`
- GCP Cloud Key Management key features - `https://cloud.google.com/security-key-management#section-2`