# CMEK for Data Encryption at Rest (AWS Only)
![`smart`](CloudVendorCMEK_en_001_20231008.png)
![`smart`](TiDBCloudCMEKProject_aa_001_20231030.png)
+ Customer-managed encryption key (CMEK) can be enabled at the project level
+ Configuration steps:
  + Create a new project with CMEK enabled
  + Create a master key in your AWS account, and register it to the specific project
  + Create a new TiDB Dedicated cluster under the specific project
------------------------------------------------------------------------------
Customer-Managed Encryption Key (CMEK) allows you to secure your static data in a TiDB Dedicated cluster by utilizing a cryptographic key that is under your complete control. This key is referred to as the CMEK key.

Once CMEK is enabled for a project, all clusters created within that project encrypt their static data using the CMEK key. Additionally, any backup data generated by these clusters is encrypted using the same key.

Master keys never leaves Cloud Infrastructure vendor key management services. And data encryption keys never leaves Cloud Infrastructure vendor key management services unencrypted.