# Key management in Amazon IoT SiteWise
<a name="key-management"></a>

## Amazon IoT SiteWise cloud key management
<a name="key-cloud-sw"></a>

By default, Amazon IoT SiteWise uses Amazon managed keys to protect your data in the Amazon Cloud. You can update your settings to use a customer managed key to encrypt some data in Amazon IoT SiteWise. You can create, manage, and view your encryption key through Amazon Key Management Service (Amazon KMS).

Amazon IoT SiteWise supports server-side encryption with customer managed keys stored in Amazon KMS to encrypt the following data:
+ Asset property values
+ Aggregate values

**Note**  
 Other data and resources are encrypted using the default encryption with keys managed by Amazon IoT SiteWise. This key is stored in the Amazon IoT SiteWise account. 

 For more information, see [What is Amazon Key Management Service?](https://docs.amazonaws.cn/kms/latest/developerguide/overview.html) in the *Amazon Key Management Service Developer Guide*. 

### Enable encryption using customer managed keys
<a name="CMK-setup"></a>

To use customer managed keys with Amazon IoT SiteWise, you need to update your Amazon IoT SiteWise settings.

**To enable encryption using KMS keys**

1.  

   Navigate to the [Amazon IoT SiteWise console](https://console.amazonaws.cn//iotsitewise/). 

1. Choose **Account Settings** and choose **Edit** to open the **Edit account settings** page. 

1.  For **Encryption key type**, choose **Choose a different Amazon KMS key**. This enables encryption with customer managed keys stored in Amazon KMS. 
**Note**  
Currently, you can only use customer managed key encryption for asset property values and aggregate values.

1. Choose your KMS key with one of the following options:
   + **To use an existing KMS key** – Choose your KMS key alias from the list. 
   + **To create a new KMS key** – Choose **Create an Amazon KMS key**.
**Note**  
This opens the Amazon KMS dashboard. For more information about creating a KMS key, see [Creating keys](https://docs.amazonaws.cn/kms/latest/developerguide/create-keys.html) in the *Amazon Key Management Service Developer Guide*.

1. Choose **Save** to update your settings.

## SiteWise Edge gateway key management
<a name="key-gateway-gg"></a>

SiteWise Edge gateways run on Amazon IoT Greengrass, and Amazon IoT Greengrass core devices use public and private keys to authenticate with the Amazon Cloud and encrypt local secrets, such as OPC UA authentication secrets. For more information, see [Key management](https://docs.amazonaws.cn/greengrass/v1/developerguide/key-management.html) in the *Amazon IoT Greengrass Version 1 Developer Guide*.